Executive brief
ViewComponent, a framework for building user interface components in Ruby on Rails, contains a flaw where component instances can retain data from previous web requests. If a component is reused across different users or sessions, it may accidentally display private information or administrative controls to the wrong person. This could lead to unauthorized access to sensitive data or the generation of malicious links using incorrect server headers.
Technical details
A vulnerability in ViewComponent::Base (versions 4.0.0 to 4.11.x) arises because render-scoped objects—including the controller, helpers, request, and view flow—are memoized using the '||=' operator during the first call to #render_in. If a component instance, collection, or spacer is reused across different requests, tenants, or threads, subsequent renders utilize the stale context from the initial render. This can result in authorization bypasses (where a low-privileged user sees UI intended for an admin), Host header injection in generated URLs, and data leakage between concurrent threads. The fix in version 4.12.0 ensures these internal variables are reset on every call to #render_in.
Affected products
- ViewComponent view_component >= 4.0.0, < 4.12.0
Timeline
- 2026-06-04: patched: Fix committed and version 4.12.0 released.
- 2026-07-17: disclosed: CVE-2026-54497 published.