Action View: Possible XSS vulnerability in highlight helper

Impact

ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the <a href="search?q=\1"> form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default <mark>\1</mark> highlighter and the block form are not affected.

Details

The fixed releases HTML-escape each group substituted into the :highlighter string, so quotes in a match are rendered as " and '. Only the numbered placeholders \0 to \9 are expanded; other String#sub replacement escapes, such as \k<name>, \& and \\, are left as written. A match can no longer begin on the > that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details.

Workarounds

Use a :highlighter that places the matched phrase only in element content, such as the default <mark>\1</mark>.

Releases

The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:

• 8.1: https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch
• 8.0: https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch

Credit

This issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).