Is CVE-2026-44837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44837 being exploited in the wild.

How severe is CVE-2026-44837?

Medium severity, with a CVSS score of 5.9, published 26 May 2026.

Which products and versions are affected?

GitHub ViewComponent >= 3.0.0, = 3.0.0, < 4.9.0, ECOSYSTEM:introduced=3.0.0,fixed=4.9.0.

Is there a fix for CVE-2026-44837?

Yes. view_component (RubyGems): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44837 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44837?

Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44837: ViewComponent path traversal in system test entrypoint

Q: Is there a fix for CVE-2026-44837?

Yes. view_component (RubyGems): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44837 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44837?

Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44837 · Severity: medium · CVSS 5.9 · Published 2026-05-26

ViewComponent is a framework for building reusable UI components in Ruby on Rails. A security flaw in its system testing component allows an attacker to access files outside of the intended temporary directory. This could lead to the exposure of sensitive application files if test routes are accidentally accessible in environments like staging or shared CI/CD pipelines.

Technologies: GitHub ViewComponent, view_component (RubyGems). Vendors: GitHub, RubyGems.

Quick answers

Is CVE-2026-44837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44837 being exploited in the wild.
How severe is CVE-2026-44837?: Medium severity, with a CVSS score of 5.9, published 26 May 2026.
Which products and versions are affected?: GitHub ViewComponent >= 3.0.0, < 4.9.0; view_component (RubyGems) >= 3.0.0, < 4.9.0, ECOSYSTEM:introduced=3.0.0,fixed=4.9.0.
Is there a fix for CVE-2026-44837?: Yes. view_component (RubyGems): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44837 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44837?: Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

view_component (RubyGems): upgrade to 4.9.0 or later
```
bundle update view_component
```

Technical details

A path traversal vulnerability exists in the `ViewComponentsSystemTestController` due to an insecure containment check. The controller uses `File.realpath` to canonicalize a user-provided path and then validates it using `start_with?` against a base directory. Because the check does not ensure the base path ends with a directory separator, an attacker can use '..' to escape to a sibling directory that shares the same string prefix (e.g., accessing `/tmp/view_components_evil/` when only `/tmp/view_components/` is allowed). This allows for arbitrary file read within the scope of the web server's permissions. The vulnerability is primarily reachable when the application is running in the Rails test environment. This issue is fixed in version 4.9.0.

Affected products

ViewComponent view_component >= 3.0.0, < 4.9.0

Identifiers

CVE-2026-44837
GHSA-hg3h-g7xc-f7vp

Timeline

2026-05-05: disclosed
2026-05-08: advisory: GitHub Advisory published
2026-05-26: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.