Executive brief
ViewComponent is a framework for building user interface components in Ruby on Rails applications. A security flaw allows certain component methods to bypass standard security protections that prevent malicious scripts from being injected into web pages. If an application uses these components to display user-provided data, an attacker could execute unauthorized scripts in other users' browsers, potentially leading to account takeover or data theft.
Technical details
A cross-site scripting (XSS) vulnerability exists in ViewComponent versions 4.0.0 through 4.11.x. The root cause is that 'ViewComponent::Base#around_render' does not apply the same HTML-escaping logic as the standard '#call' method, allowing HTML-unsafe strings to be rendered raw. This risk is significantly amplified when using 'ViewComponent::Collection#render_in', which joins per-item results and explicitly marks the entire output as 'html_safe', effectively laundering unsafe strings into trusted 'ActiveSupport::SafeBuffer' objects. An attacker can exploit this by providing malicious input that is subsequently processed by a component using 'around_render' for wrapping or instrumentation. The issue is fixed in version 4.12.0 by ensuring 'around_render' output is escaped and using 'safe_join' for collections.
Affected products
- ViewComponent view_component >= 4.0.0, < 4.12.0
Timeline
- 2026-06-04: patched: Fixes committed and version 4.12.0 released.
- 2026-07-17: disclosed: Public advisory published.
References
- https://github.com/ViewComponent/view_component/commit/48e5fd2d602344c7d33019fbc5c8b087e315bb78
- https://github.com/ViewComponent/view_component/commit/6796b2e89d0bd7b9d7d763a86275e5334731dd61
- https://github.com/ViewComponent/view_component/releases/tag/v4.12.0
- https://github.com/ViewComponent/view_component/security/advisories/GHSA-97jw-64cj-jc58