CVE-2026-54497 Details
Description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. This issue is fixed in version 4.12.0.
A vulnerability exists in the ViewComponent library for Ruby on Rails, specifically in versions 4.0.0 through 4.12.0. The issue arises because ViewComponent::Base instances retain render-scoped objects across multiple calls to render_in. When the same component, collection, or spacer component instance is reused across different requests, users, tenants, or threads, it can lead to the use of stale helpers, controller, request, view_flow, format/variant details, and slot child context from previous renders. This can cause authorization-aware components to display privileged UI to lower-privileged users, generate links with outdated Host headers, leak slot/helper states, and mix request contexts during concurrent rendering.
The vulnerability has been fixed in ViewComponent version 4.12.0. Users should update to this version to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ViewComponent/view_component/security/advisories/GHSA-9h85-g7w3-rh49 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/ViewComponent/view_component/commit/6796b2e89d0bd7b9d7d763a86275e5334731dd61 | [email protected] | Patch |
| https://github.com/ViewComponent/view_component/releases/tag/v4.12.0 | [email protected] | ProductRelease Notes |
| https://github.com/ViewComponent/view_component/security/advisories/GHSA-9h85-g7w3-rh49 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-488 | Exposure of Data Element to Wrong Session | [email protected] |
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| viewcomponent view component | >= 4.0.0, < 4.12.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |