CVE-2026-44836: ViewComponent unauthorized template rendering in preview route

Executive brief

ViewComponent is a framework for building reusable UI components in Ruby on Rails. A vulnerability in its preview feature allows an attacker to force the application to render internal templates that are normally restricted. This could lead to the exposure of sensitive information such as application secrets, configuration details, or administrative data.

Technical details

The ViewComponent preview route uses `public_send` to dispatch methods based on URL parameters without verifying if the method is an explicitly defined preview example. This allows an attacker to invoke inherited public methods from `ViewComponent::Preview`, specifically `render_with_template`. By providing a `template` path and `locals` via request parameters, an attacker can render arbitrary internal Rails templates. This vulnerability requires the preview routes to be enabled and reachable. The issue is fixed in version 4.9.0 by enforcing that only explicitly declared preview examples can be dispatched.

Affected products

• ViewComponent view_component >= 3.0.0, < 4.9.0

Timeline

• 2026-05-05: disclosed: Advisory published by maintainers
• 2026-05-08: advisory: GitHub Advisory published
• 2026-05-26: advisory: NVD published CVE-2026-44836

References

• https://api.github.com/users/cyberlanc3r
• https://github.com/cyberlanc3r
• https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D
• https://api.github.com/users/cyberlanc3r/repos
• https://avatars.githubusercontent.com/u/216992819?v=4
• https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D