CVE-2026-126075

Name of the Vulnerable Software and Affected Versions Active Support versions 8.1 through 8.1.4

Description ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer using only its bytes and deserializes it as a new SafeBuffer. This process causes buffers that are no longer html safe? (such as those mutated in place using gsub!) to be restored as html safe. When such a buffer contains untrusted input and is processed via a MessagePack serializer, rendering the loaded data bypasses ERB auto-escaping, which can lead to Cross-Site Scripting (XSS). This occurs when applications use a MessagePack serializer for config.action dispatch.cookies serializer (set to :message pack or :message pack allow marshal), Rails.cache, ActiveSupport::MessageVerifier, or ActiveSupport::MessageEncryptor, and store a SafeBuffer mutated with untrusted input.

Recommendations Update to version 8.1.4.1. As a temporary workaround, convert a SafeBuffer to a String using the to str method before storing it in a value handled by a MessagePack serializer.