Mittel 4.7Linux-Server
CVE-2026-126075
activesupport: Active Support: Cross-site scripting via MessagePack deserialization
activesupport
### Impact `ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no longer `html_safe?` (for example, one mutated in place with `gsub!`) is restored as `html_safe`. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if…
10. Nov 2026
Original bei Red Hat öffnen