CVE-2026-126079: Anthropic Python XSS

CISO Take

Rails ActionView's `highlight` and `simple_format` helpers can emit live HTML from attacker-controlled attribute values because Nokogiri before 1.19.5 serializes `<` and `>` unescaped in the HTML5 sanitizer output, causing reflected or stored XSS (CWE-79, CVSS 6.1, medium). This is a general web framework flaw rather than an AI-specific one, but it matters for AI-facing Rails apps such as chat UIs and LLM dashboards that render model output or user text through these helpers. Exploitation likelihood is low: EPSS is 0.34% (72nd percentile), the flaw is not in CISA KEV, and there is no public exploit or Nuclei template. The blast radius is wide, with 6,440 downstream dependents, and the affected helpers are common. Upgrade Nokogiri to 1.19.5 or later, or move to actionview 8.1.4.1 (8.0.5.2 for the 8.0 line). If you can't upgrade now, set `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`.

Sources:NVDGitHub AdvisoryEPSSATLASrails.github.io

What is the risk?

Medium. The attack is network-reachable with low complexity and no privileges, but it needs user interaction (CVSS 6.1, scope changed). Only apps that use the HTML5 sanitizer (the default with `load_defaults 7.1` or later on CRuby) and pass untrusted text to `highlight`, or to `simple_format` with `html_options`, are exposed. EPSS is low (0.34%), there is no known exploitation or public PoC, and it is not in KEV. For AI/ML systems the risk rises where LLM output or user prompts are rendered through these helpers, because model output is an untrusted input channel that is easy to steer.

How does the attack unfold?

Initial Access

Attacker submits crafted text with a `>` and markup inside an attribute value to a Rails app that handles untrusted input.

AML.T0049

Exploitation

The app passes the sanitized text to `highlight` or `simple_format`, which splits it on tag boundaries or blank lines and emits the inert markup as live HTML.

Execution

A victim opens the page and the injected script runs in their browser under the application's origin.

AML.T0011.003

Impact

The attacker steals session tokens, API keys or conversation data shown in the AI application's UI.

Initial Access

Attacker submits crafted text with a `>` and markup inside an attribute value to a Rails app that handles untrusted input.

AML.T0049

Exploitation

The app passes the sanitized text to `highlight` or `simple_format`, which splits it on tag boundaries or blank lines and emits the inert markup as live HTML.

Execution

A victim opens the page and the injected script runs in their browser under the application's origin.

AML.T0011.003

Impact

The attacker steals session tokens, API keys or conversation data shown in the AI application's UI.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	rubygems	>= 8.1.0.beta1, < 8.1.4.1	`8.1.4.1`
4.1K6.4K dependentsPushed 8d ago94% patched~11d to patchFull package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade Nokogiri to 1.19.5 or later (this alone fixes the issue, no Rails upgrade needed), and move to actionview 8.1.4.1 or 8.0.5.2, which require rails-html-sanitizer 1.7.2 or later. 2) If you can't upgrade immediately, set config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer, or apply the backport patches for 8.0 and 8.1 from the Rails commits. 3) Audit code that calls highlight or simple_format with html_options on untrusted input, including LLM output. 4) Check tests that compare sanitized HTML as strings, since the serialization now escapes < and > in attributes. 5) Enforce a strict Content-Security-Policy to limit XSS impact, and review logs for attribute values containing > followed by tag-like content.

How is it classified?

Data LeakageFrameworkAPIAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and supply chain risks

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-126079?

Rails ActionView's `highlight` and `simple_format` helpers can emit live HTML from attacker-controlled attribute values because Nokogiri before 1.19.5 serializes `<` and `>` unescaped in the HTML5 sanitizer output, causing reflected or stored XSS (CWE-79, CVSS 6.1, medium). This is a general web framework flaw rather than an AI-specific one, but it matters for AI-facing Rails apps such as chat UIs and LLM dashboards that render model output or user text through these helpers. Exploitation likelihood is low: EPSS is 0.34% (72nd percentile), the flaw is not in CISA KEV, and there is no public exploit or Nuclei template. The blast radius is wide, with 6,440 downstream dependents, and the affected helpers are common. Upgrade Nokogiri to 1.19.5 or later, or move to actionview 8.1.4.1 (8.0.5.2 for the 8.0 line). If you can't upgrade now, set `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`.

Is CVE-2026-126079 actively exploited?

No confirmed active exploitation of CVE-2026-126079 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126079?

1) Upgrade Nokogiri to 1.19.5 or later (this alone fixes the issue, no Rails upgrade needed), and move to actionview 8.1.4.1 or 8.0.5.2, which require rails-html-sanitizer 1.7.2 or later. 2) If you can't upgrade immediately, set `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`, or apply the backport patches for 8.0 and 8.1 from the Rails commits. 3) Audit code that calls `highlight` or `simple_format` with `html_options` on untrusted input, including LLM output. 4) Check tests that compare sanitized HTML as strings, since the serialization now escapes `<` and `>` in attributes. 5) Enforce a strict Content-Security-Policy to limit XSS impact, and review logs for attribute values containing `>` followed by tag-like content.

What systems are affected by CVE-2026-126079?

This vulnerability affects the following AI/ML architecture patterns: Rails-based LLM chat front-ends, RAG search and results UIs, AI admin and observability dashboards.

What is the CVSS score for CVE-2026-126079?

CVE-2026-126079 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

Rails-based LLM chat front-endsRAG search and results UIsAI admin and observability dashboards

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

### Impact With the HTML5 sanitizer (`Rails::HTML5::Sanitizer`, the default vendor on CRuby for applications using `load_defaults 7.1` or later), Nokogiri before 1.19.5 serializes `<` and `>` unescaped inside attribute values. The Action View text helpers `highlight` and `simple_format` sanitize their input and then process the resulting HTML as a string: `highlight` splits it on tag boundaries to insert matches, and `simple_format` splits it into paragraphs on blank lines. An unescaped `>` or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's `html_safe` output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to `highlight`, or to `simple_format` with `html_options`, are affected. ### Details The fixed releases require rails-html-sanitizer 1.7.2 or later, which requires Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer escapes `<` and `>` in attribute values as `<` and `>`, as the HTML4 sanitizer already does. The parsed DOM is unchanged, but code or tests that compare sanitized HTML as a string may see the new serialization. ### Workarounds Upgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer, so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by setting `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`. ### Releases The fixed releases are available at the normal locations. Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73.patch - 8.0: https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11.patch ### Credit This issue was responsibly reported by HackerOne researcher [azaran](https://hackerone.com/azaran). This issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0).

Exploitation Scenario

An attacker submits text containing an attribute value with an embedded `>` and markup, for example a crafted prompt or document title, to a Rails-based AI search or chat application. The sanitizer treats the markup as inert inside the attribute. The app then passes the stored text to `highlight` to mark search terms, and the helper splits the output on tag boundaries, turning the inert markup into live elements. When a victim analyst or another user opens the results page, the injected script runs in their session and can exfiltrate conversation history, API tokens or admin session cookies.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.