SafeBuffer#% does not propagate the @html_unsafe attribute when a SafeBuffer is mutated in place and then formatted. If an attacker can supply untrusted arguments to the % operation on such a buffer, the resulting string is mistakenly marked as html_safe. This bypasses ERB’s automatic escaping and can cause malicious scripts to execute in a user’s browser, compromising confidentiality and integrity of the rendered page.

The issue affects the Rails ActiveSupport library in Ruby on Rails. All Rails releases prior to 7.2.3.1, 8.0.4.1, and 8.1.2.1 are vulnerable. Users running Rails 7.2.3, 8.0.4, or 8.1.2 before the corresponding patch releases are impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to provide untrusted input that is passed as a format argument after a SafeBuffer has been mutated in place. If the application accepts user‑supplied data into such formatting contexts, a remote or local XSS attack could be performed. Due to the need for specific code paths, the likelihood remains low but the impact could be significant for affected users.