CyberRota Analysis
AI-GeneratedThe view_component framework in Ruby on Rails versions 4.0.0 to 4.12.0 is vulnerable due to improper handling of render-scoped objects, which can lead to stale context being used in subsequent renders. This may allow unauthorized users to access privileged UI elements, generate links with outdated Host headers, and potentially leak sensitive state information across concurrent requests. Developers and organizations using affected versions should prioritize upgrading to version 4.12.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. This issue is fixed in version 4.12.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)