Action Pack on Rails versions 8.1.x prior to 8.1.2.1 fails to escape messages shown on the debug exceptions page, allowing an attacker to inject arbitrary HTML or JavaScript when a crafted exception is raised. This injection results in a client‑side cross‑site scripting (XSS) condition that can be leveraged to deface pages, execute scripts in the user’s browser, or steal session data. The weakness aligns with CWE‑79 and only occurs when detailed exception pages are enabled, which is the default in development environments.

Applications built with the Rails framework that include the Action Pack gem and are running Rails 8.1.x before 8.1.2.1. The vulnerability is limited to instances where the setting config.consider_all_requests_local is true, typically in non‑production deployments.

The CVSS score is 1.3, reflecting a very low severity that is valid only when debug mode is active. Exploitation requires the attacker to cause a specific exception with a crafted message, which generally means the attacker must already have code‑execution or code‑upload capabilities in the application. The vulnerability is not listed in the CISA KEV catalog and EPSS data is unavailable, suggesting a minimal likelihood of widespread exploitation in the wild.