Junglewise Threat Intelligence

CVE-2026-54498: ViewComponent XSS via around_render HTML-safety bypass

CVE-2026-54498 · Severity: high · CVSS 8.7 · Published 2026-07-17

Technologies: view_component (RubyGems), GitHub ViewComponent. Vendors: RubyGems, GitHub.

Executive brief

ViewComponent is a framework for building user interface components in Ruby on Rails applications. A security flaw allows certain component methods to bypass standard security protections that prevent malicious scripts from being injected into web pages. If an application uses these components to display user-provided data, an attacker could execute unauthorized scripts in other users' browsers, potentially leading to account takeover or data theft.

Technical details

A cross-site scripting (XSS) vulnerability exists in ViewComponent versions 4.0.0 through 4.11.x. The root cause is that 'ViewComponent::Base#around_render' does not apply the same HTML-escaping logic as the standard '#call' method, allowing HTML-unsafe strings to be rendered raw. This risk is significantly amplified when using 'ViewComponent::Collection#render_in', which joins per-item results and explicitly marks the entire output as 'html_safe', effectively laundering unsafe strings into trusted 'ActiveSupport::SafeBuffer' objects. An attacker can exploit this by providing malicious input that is subsequently processed by a component using 'around_render' for wrapping or instrumentation. The issue is fixed in version 4.12.0 by ensuring 'around_render' output is escaped and using 'safe_join' for collections.

Affected products

  • ViewComponent view_component >= 4.0.0, < 4.12.0

Timeline

  • 2026-06-04: patched: Fixes committed and version 4.12.0 released.
  • 2026-07-17: disclosed: Public advisory published.

References

Related threats