view_component: Reused Component Instances Retain Stale Render Context
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. This issue is fixed in version 4.12.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ViewComponent | view_component | 4.0.0 to before 4.12.0 | 4.12.0 | Patch available | CNA |
| — | view_component (RubyGems) | 4.0.0 to before 4.12.0 | 4.12.0 | Patch available | GHSA-9h85-g7w3-rh49 |
- view_component VendorViewComponent Affected 4.0.0 to before 4.12.0 Fixed in 4.12.0 Patch available CNA
- view_component (RubyGems) Vendor— Affected 4.0.0 to before 4.12.0 Fixed in 4.12.0 Patch available GHSA-9h85-g7w3-rh49
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:viewcomponent:view_component:*:*:*:*:*:ruby:*:* | 4.0.0 to before 4.12.0 | Vulnerable | ViewComponent |
- cpe:2.3:a:viewcomponent:view_component:*:*:*:*:*:ruby:*:* Versions 4.0.0 to before 4.12.0 Vulnerable ·ViewComponent
Remediation
- Fix · CNA view_component (ViewComponent) Fixed in 4.12.0
- Fix · GHSA-9h85-g7w3-rh49 view_component (RubyGems) Fixed in 4.12.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54497
- 2026-10-03 Alias added: GHSA-9h85-g7w3-rh49
References
Patch 1
Other 5
- https://github.com/ViewComponent/view_component/releases/tag/v4.12.0
- https://github.com/ViewComponent/view_component/commit/7b05073be28037f7d5ff141e9dd42f3cf47956a4
- https://github.com/ViewComponent/view_component
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/view_component/CVE-2026-54497.yml
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54497
More ViewComponent View Component vulnerabilities
- TI-2026-39344 view_component: around_render HTML-Safety Bypass CVSS 3.1HIGH 8.7
- TI-2026-32717 view_component: System Test Entry Point Path Check Allows Sibling Directory Escape CVSS 3.1HIGH 7.5
- TI-2024-14361 view_component Cross-site Scripting vulnerability CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-54497 · CVE Program
- CVE-2026-54497 · NVD
- FIRST EPSS
- GHSA-9h85-g7w3-rh49 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences