CVE-2026-126070

Name of the Vulnerable Software and Affected Versions Action View versions prior to 8.1.4.1 Action View versions prior to 8.0.5.2

Description The strip tags() function in Action View returns sanitized output marked as html safe, but the underlying sanitizer only encodes &, <, and >, leaving double quotes (") and single quotes (') unencoded. Since ERB does not escape strings marked as html safe, untrusted input processed by strip tags() and rendered within a quoted HTML attribute (such as a title attribute or a <meta content> tag) can allow an attacker to close the attribute and inject new attributes, potentially leading to Cross-Site Scripting (XSS), which is a technique used to inject malicious scripts into web pages. Output rendered as element content is not affected.

Recommendations Update to version 8.1.4.1. Update to version 8.0.5.2. As a temporary workaround, avoid rendering the output of the strip tags() function inside HTML attributes when handling untrusted input.