Is CVE-2026-44836 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44836 being exploited in the wild.

How severe is CVE-2026-44836?

Medium severity, with a CVSS score of 6.5, published 26 May 2026.

Which products and versions are affected?

GitHub ViewComponent >= 3.0.0, = 3.0.0, < 4.9.0, ECOSYSTEM:introduced=3.0.0,fixed=4.9.0.

Is there a fix for CVE-2026-44836?

Yes. view_component (RubyGems): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44836 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44836?

Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44836: ViewComponent unauthorized template rendering in preview route

Q: Is there a fix for CVE-2026-44836?

Yes. view_component (RubyGems): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44836 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44836?

Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44836 · Severity: medium · CVSS 6.5 · Published 2026-05-26

ViewComponent is a framework for building reusable UI components in Ruby on Rails. A vulnerability in its preview feature allows an attacker to force the application to render internal templates that are normally restricted. This could lead to the exposure of sensitive information such as application secrets, configuration details, or administrative data.

Technologies: GitHub ViewComponent, view_component (RubyGems). Vendors: GitHub, RubyGems.

Quick answers

Is CVE-2026-44836 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44836 being exploited in the wild.
How severe is CVE-2026-44836?: Medium severity, with a CVSS score of 6.5, published 26 May 2026.
Which products and versions are affected?: GitHub ViewComponent >= 3.0.0, < 4.9.0; view_component (RubyGems) >= 3.0.0, < 4.9.0, ECOSYSTEM:introduced=3.0.0,fixed=4.9.0.
Is there a fix for CVE-2026-44836?: Yes. view_component (RubyGems): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44836 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44836?: Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

view_component (RubyGems): upgrade to 4.9.0 or later
```
bundle update view_component
```

Technical details

The ViewComponent preview route uses `public_send` to dispatch methods based on URL parameters without verifying if the method is an explicitly defined preview example. This allows an attacker to invoke inherited public methods from `ViewComponent::Preview`, specifically `render_with_template`. By providing a `template` path and `locals` via request parameters, an attacker can render arbitrary internal Rails templates. This vulnerability requires the preview routes to be enabled and reachable. The issue is fixed in version 4.9.0 by enforcing that only explicitly declared preview examples can be dispatched.

Affected products

ViewComponent view_component >= 3.0.0, < 4.9.0

Identifiers

CVE-2026-44836
GHSA-7f3r-gwc9-2995

Timeline

2026-05-05: disclosed: Advisory published by maintainers
2026-05-08: advisory: GitHub Advisory published
2026-05-26: advisory: NVD published CVE-2026-44836

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.