Temporary (upgrade to Rails 4.2.7.1 / 5.0.0.1) workaround for CVE-2016-6316 (see: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk). Only tested with Rails 4.1. Place in config/initializers.

cve_2016_6316_workaround.rb

if Rails::VERSION::MINOR < 2 && Rails::VERSION::MAJOR >= 4
  module ActionView
    module Helpers
      module TagHelper
        private

        def tag_option(key, value, escape)
          value = value.join(" ") if value.is_a?(Array)
          value = ERB::Util.h(value) if escape
          %(#{key}="#{value.gsub(/"/, '&quot;'.freeze)}")
        end
      end
    end
  end
end

Any reason you used private to define that method when in Rails code it's not?
https://github.com/rails/rails/blob/master/actionview/lib/action_view/helpers/tag_helper.rb#L87