Bug 2571239 (CVE-2026-126069)

Summary: CVE-2026-126069 actionview: actionview: Cross-site scripting via whitespace HTML attribute names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akostadi, amasferr, dmayorov, ehelms, eshamard, jlledo, jpasqual, juwatts, jvasik, kaycoth, lblicha, mhulan, ogajduse, osousa, pantinor, rblanco, rchan, smallamp, tsedmik, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Action View. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS) attacks when an application allows user-controlled HTML attribute names. Due to improper validation of whitespace-only attribute names in HTML tag helpers, the component generates malformed markup. As a result, a client browser can misinterpret crafted attribute values as separate attributes or executable scripts within the victim's session.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 20:57:51 UTC 
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, the fix for CVE-2026-33168 skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as :" ", is not blank, because Symbol#blank? is Symbol#empty?, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as image_tag, video_tag and audio_tag, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.