CVE-2026-54497: ViewComponent stale render context in reused component instances

CVE-2026-54497 · Severity: medium · CVSS 6.8 · Published 2026-07-17

ViewComponent, a framework for building user interface components in Ruby on Rails, contains a flaw where component instances can retain data from previous web requests. If a component is reused across different users or sessions, it may accidentally display private information or administrative controls to the wrong person. This could lead to unauthorized access to sensitive data or the generation of malicious links using incorrect server headers.

Technologies: GitHub ViewComponent, view_component (RubyGems). Vendors: GitHub, RubyGems.

Quick answers

Is CVE-2026-54497 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54497 being exploited in the wild.
How severe is CVE-2026-54497?
Medium severity, with a CVSS score of 6.8, published 17 July 2026.
Which products and versions are affected?
GitHub ViewComponent >= 4.0.0, < 4.12.0; view_component (RubyGems) >= 4.0.0, < 4.12.0, ECOSYSTEM:introduced=4.0.0,fixed=4.12.0.
Is there a fix for CVE-2026-54497?
Yes. view_component (RubyGems): upgrade to 4.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54497 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54497?
Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • view_component (RubyGems): upgrade to 4.12.0 or later
    bundle update view_component

Technical details

A vulnerability in ViewComponent::Base (versions 4.0.0 to 4.11.x) arises because render-scoped objects—including the controller, helpers, request, and view flow—are memoized using the '||=' operator during the first call to #render_in. If a component instance, collection, or spacer is reused across different requests, tenants, or threads, subsequent renders utilize the stale context from the initial render. This can result in authorization bypasses (where a low-privileged user sees UI intended for an admin), Host header injection in generated URLs, and data leakage between concurrent threads. The fix in version 4.12.0 ensures these internal variables are reset on every call to #render_in.

Affected products

  • ViewComponent view_component >= 4.0.0, < 4.12.0

Identifiers

  • CVE-2026-54497
  • GHSA-9h85-g7w3-rh49

Timeline

  • 2026-06-04: patched: Fix committed and version 4.12.0 released.
  • 2026-07-17: disclosed: CVE-2026-54497 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.