CVE-2026-126078: Anthropic Python XSS

CISO Take

CVE-2026-126078 is a cross-site scripting flaw in Rails ActionView's `highlight` helper: matched phrases are inserted into a custom `:highlighter` string without HTML escaping, so a quote in a user-controlled match can break out of a quoted attribute value and inject attributes. The practical exposure is narrow, because only apps that pass a custom `:highlighter` with a placeholder inside an attribute (for example `<a href="search?q=\1">`) and highlight user-controlled text are affected. The default `\1` highlighter and the block form are not. The package has 6,440 downstream dependents, but EPSS is low (0.00338, top 72%), there is no public exploit or Nuclei template, and it is not in CISA KEV, so this is a routine-priority patch rather than an emergency. Upgrade to actionview 8.1.4.1 (8.0.5.2 for the 8.0 line), or switch to the default highlighter, and grep your codebase for `highlight(` calls that use a custom `:highlighter` string.

Sources:NVDGitHub AdvisoryEPSSATLAS

What is the risk?

Medium (CVSS 6.1). Exploitation is remote and needs no privileges, but it needs user interaction and a specific, non-default code pattern: a custom `:highlighter` that places a placeholder inside a quoted attribute, applied to attacker-influenced text. EPSS of 0.00338 (72nd percentile) is low, there is no public exploit and no KEV listing. Scope is changed (S:C) because injected script runs in the victim's browser session. The AI/ML relevance is indirect: the flaw is in a general web framework that may front AI search, chat or RAG interfaces built on Rails.

How does the attack unfold?

Initial Access

Attacker crafts a link or input whose search phrase contains a quote and extra attributes, targeting a page that uses a custom highlighter.

AML.T0011.003

Exploitation

The unescaped match closes the quoted attribute in the highlighter string and injects attributes such as an event handler into the HTML-safe output.

AML.T0049

Impact

Script executes in the victim's browser session, enabling session hijacking or data theft from the AI application.

Initial Access

Attacker crafts a link or input whose search phrase contains a quote and extra attributes, targeting a page that uses a custom highlighter.

AML.T0011.003

Exploitation

The unescaped match closes the quoted attribute in the highlighter string and injects attributes such as an event handler into the HTML-safe output.

AML.T0049

Impact

Script executes in the victim's browser session, enabling session hijacking or data theft from the AI application.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	rubygems	>= 8.1.0.beta1, < 8.1.4.1	`8.1.4.1`
4.1K6.4K dependentsPushed 8d ago94% patched~11d to patchFull package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade actionview/Rails to 8.1.4.1 or 8.0.5.2. If you cannot upgrade at once, apply the vendor patch commits for 8.1 or 8.0. 2) Workaround: use a :highlighter that places the match only in element content, such as the default \1. 3) Audit the code (grep -rn "highlight(" app/) for custom highlighter strings with placeholders inside attributes. 4) After the fix, note that escaping does not make placeholders safe in unquoted attributes, URLs, JavaScript, CSS or HTML-valued attributes, so avoid those contexts. 5) Add a strict Content-Security-Policy to limit the impact of any XSS and monitor for odd query strings containing quote characters in search endpoints.

How is it classified?

Data LeakageFrameworkAPIAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to identified risks and unknown risks

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-126078?

CVE-2026-126078 is a cross-site scripting flaw in Rails ActionView's `highlight` helper: matched phrases are inserted into a custom `:highlighter` string without HTML escaping, so a quote in a user-controlled match can break out of a quoted attribute value and inject attributes. The practical exposure is narrow, because only apps that pass a custom `:highlighter` with a placeholder inside an attribute (for example `<a href="search?q=\1">`) and highlight user-controlled text are affected. The default `\1` highlighter and the block form are not. The package has 6,440 downstream dependents, but EPSS is low (0.00338, top 72%), there is no public exploit or Nuclei template, and it is not in CISA KEV, so this is a routine-priority patch rather than an emergency. Upgrade to actionview 8.1.4.1 (8.0.5.2 for the 8.0 line), or switch to the default highlighter, and grep your codebase for `highlight(` calls that use a custom `:highlighter` string.

Is CVE-2026-126078 actively exploited?

No confirmed active exploitation of CVE-2026-126078 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126078?

1) Upgrade actionview/Rails to 8.1.4.1 or 8.0.5.2. If you cannot upgrade at once, apply the vendor patch commits for 8.1 or 8.0. 2) Workaround: use a `:highlighter` that places the match only in element content, such as the default `\1`. 3) Audit the code (`grep -rn "highlight(" app/`) for custom highlighter strings with placeholders inside attributes. 4) After the fix, note that escaping does not make placeholders safe in unquoted attributes, URLs, JavaScript, CSS or HTML-valued attributes, so avoid those contexts. 5) Add a strict Content-Security-Policy to limit the impact of any XSS and monitor for odd query strings containing quote characters in search endpoints.

What systems are affected by CVE-2026-126078?

This vulnerability affects the following AI/ML architecture patterns: Rails-based AI web front ends, RAG search interfaces, LLM chat and assistant UIs, ML dashboards and admin consoles.

What is the CVSS score for CVE-2026-126078?

CVE-2026-126078 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

Rails-based AI web front endsRAG search interfacesLLM chat and assistant UIsML dashboards and admin consoles

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

### Impact `ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase into the `:highlighter` string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the `<a href="search?q=\1">` form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a `:highlighter` that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default `\1` highlighter and the block form are not affected. ### Details The fixed releases HTML-escape each group substituted into the `:highlighter` string, so quotes in a match are rendered as `"` and `'`. Only the numbered placeholders `\0` to `\9` are expanded; other `String#sub` replacement escapes, such as `\k<name>`, `\&` and `\\`, are left as written. A match can no longer begin on the `>` that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details. ### Workarounds Use a `:highlighter` that places the matched phrase only in element content, such as the default `\1`. ### Releases The fixed releases are available at the normal locations. Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch - 8.0: https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch ### Credit This issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).

Exploitation Scenario

A Rails-based internal AI knowledge assistant shows search results with the user's query highlighted via `highlight(text, params[:q], highlighter: '<a href="search?q=\1">\1</a>')`. An attacker crafts a link whose query contains a quote followed by an event handler attribute, such as `x" onmouseover="...`. When a logged-in analyst opens the link and interacts with the highlighted result, the injected attribute runs script in the application's origin. The script can read the page, call internal LLM or model-management endpoints with the victim's session, and exfiltrate data.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.