Medium 6.1Published Mar 23, 2026

CVE-2026-33167Action Pack is a Rubygem for building web applications on the Rails framework.

Updated under an hour ago (2026-10-19 09:40 UTC)

Does this affect you?

It affects rubyonrails rails. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for rubyonrails rails

Exploited in the last 30 days

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

CVSS: 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Aug 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

rubyonrails rails rubyonrails:rails	from 8.1.0 before 8.1.2.1	NVD

References

https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0patch
https://github.com/rails/rails/releases/tag/v8.1.2.1release-notes
https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.