CVE-2026-33167: Rails has a possible XSS vulnerability in its Action Pack debug exceptions
(updated )
The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.consider_all_requests_local = true), which is the default in development.
References
- github.com/advisories/GHSA-pgm4-439c-5jp6
- github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
- github.com/rails/rails/releases/tag/v8.1.2.1
- github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
- github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml
- nvd.nist.gov/vuln/detail/CVE-2026-33167
Code Behaviors & Features
Detect and mitigate CVE-2026-33167 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →