Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails     framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the     `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`)     and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? ==     true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1     contain a patch. (CVE-2026-33170)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails
    framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the
    `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`)
    and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? ==
    true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
    contain a patch. (CVE-2026-33170)

ID	Name	Product	Family	Type	Severity
333923	Photon OS 5.0: Rubygem PHSA-2026-5.0-91-0802	Nessus	PhotonOS Local Security Checks	Local	high
305990	Photon OS 4.0: Rubygem PHSA-2026-4.0-0995	Nessus	PhotonOS Local Security Checks	Local	high
305120	Photon OS 5.0: Rubygem PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	Local	high
303641	Linux Distros Unpatched Vulnerability : CVE-2026-33170	Nessus	Misc.	Local	medium
439123	SCA: security update for activesupport (GHSA-89vf-4333-qx8v)	Tenable Cloud Security	SCA Checks	Local	medium
439123	SCA: security update for activesupport (GHSA-89vf-4333-qx8v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-33170

medium

Tenable Plugins

high

high

high

medium

medium

medium