Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: >= 8.1.0.beta1, < 8.1.4.1
Patched in 8.1.4.1
Vulnerable: < 8.0.5.2
Patched in 8.0.5.2
Details
strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected.
strip_tags now encodes " and ' in its output, as well as &, < and >, without double-encoding existing entities. Applications that use strip_tags output outside HTML, such as in a text template or JSON, now see " and ' where they saw " and '; CGI.unescapeHTML decodes them. See the Action View CHANGELOG.
Pass strip_tags output to an attribute through a tag helper, which escapes attribute values, for example tag.a(title: strip_tags(user_input)).
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher lucasluitjes.
EPSS, exploit probability
Low0.27%
estimated chance of real-world exploitation in the next 30 days, higher than 19.3% of every CVE FIRST.org scores
Refreshed 11/13/2026, via FIRST.org's EPSS model, not CVSS, this measures likelihood of exploitation, not how severe it would be.
More rubygems advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.