Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1     branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A     carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to     XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local     = true`), which is the default in development. Version 8.1.2.1 contains a patch. (CVE-2026-33167)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1
    branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A
    carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to
    XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local
    = true`), which is the default in development. Version 8.1.2.1 contains a patch. (CVE-2026-33167)

ID	Name	Product	Family	Severity
304109	Linux Distros Unpatched Vulnerability : CVE-2026-33167	Nessus	Misc.	medium
439113	SCA: security update for actionpack (GHSA-pgm4-439c-5jp6)	Tenable Cloud Security	SCA Checks	medium
439113	SCA: security update for actionpack (GHSA-pgm4-439c-5jp6)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33167

medium

Tenable Plugins

medium

medium

medium