Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Action View provides conventions and helpers for building web pages with the Rails framework. Prior to     versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action     View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted     attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading     to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1,     8.0.4.1, and 7.2.3.1 contain a patch. (CVE-2026-33168)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Action View provides conventions and helpers for building web pages with the Rails framework. Prior to
    versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action
    View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted
    attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading
    to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1,
    8.0.4.1, and 7.2.3.1 contain a patch. (CVE-2026-33168)

ID	Name	Product	Family	Severity
303675	Linux Distros Unpatched Vulnerability : CVE-2026-33168	Nessus	Misc.	low
439115	SCA: security update for actionview (GHSA-v55j-83pf-r9cq)	Tenable Cloud Security	SCA Checks	low
439115	SCA: security update for actionview (GHSA-v55j-83pf-r9cq)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-33168

low

Tenable Plugins

low

low

low