Bug 2571277 (CVE-2026-126079)

Summary:	CVE-2026-126079 actionview: actionview: Cross-site scripting via improper handling of sanitized attributes in text helpers
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akostadi, amasferr, dmayorov, ehelms, eshamard, jlledo, jpasqual, juwatts, jvasik, kaycoth, lblicha, mhulan, ogajduse, osousa, pantinor, rblanco, rchan, smallamp, tsedmik, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Action View. This vulnerability can lead to cross-site scripting (XSS) due to improper handling of sanitized HTML attributes within text helper methods. When an application passes untrusted input to text helpers such as highlight or simple_format, subsequent string manipulation may cause inert attribute values containing unescaped characters or line breaks to be rendered as active markup. A remote attacker can exploit this issue by submitting crafted text to execute arbitrary script in the context of a victim's browser session.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 21:21:33 UTC

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.