CVE-2026-126069

Name of the Vulnerable Software and Affected Versions Action View versions prior to 8.1.4.1 Action View versions prior to 8.0.5.2

Description Action View tag helpers fail to properly handle HTML attribute names consisting only of whitespace when they are provided as Symbols or passed to asset tag helpers like image tag, video tag, and audio tag. Because the system tests if the name is blank before converting it to a string, a whitespace Symbol is not identified as blank, resulting in the emission of an attribute with no name and the production of malformed HTML. This can allow a crafted attribute value to be misinterpreted by the browser as a separate attribute name, potentially leading to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. This issue affects applications that allow users to specify custom HTML attribute names.

Recommendations Update to version 8.1.4.1. Update to version 8.0.5.2.