CVE-2026-54498highCWE-79

CVE-2026-54498: high-severity vulnerability in ViewComponent view_component

view_component: around_render HTML-Safety Bypass

Published · Updated

Follow this CVE+ Monitor view component+ Monitor view_component

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied to normal #call return values. This creates an XSS risk when downstream applications use around_render to wrap, replace, instrument, or conditionally return content that includes user-controlled data, and ViewComponent::Collection#render_in can amplify the issue by joining per-item results and marking the entire output html_safe, converting raw unsafe output into an ActiveSupport::SafeBuffer. This issue is fixed in version 4.12.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected products
ViewComponent · view_component
Related CVEs — ViewComponent view_component

In the same product, most dangerous first.

CVE-2024-21636MEDIUMview_component Cross-site Scripting vulnerabilityEPSS 0.5%CVE-2026-44837MEDIUMview_component: System Test Entry Point Path Check Allows Sibling Directory EscapeEPSS 0.4%CVE-2026-44836MEDIUMview_component: Preview Route Can Dispatch Inherited Helper MethodsEPSS 0.3%CVE-2026-54497MEDIUMview_component: Reused Component Instances Retain Stale Render ContextEPSS 0.3%