view_component vulnerabilities

2 known vulnerabilities in view_component from ViewComponent. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  view_component: Improper Neutralization of Input During Web Page Generation

  CVE-2026-54498Jul 17, 2026ViewComponent

  view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied to normal #cal

• 7.5 High severity

  view_component: Partial String Comparison

  CVE-2026-44837May 26, 2026ViewComponent

  view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved pat