CyberRota Analysis
AI-GeneratedThe view_component framework in Ruby on Rails versions 4.0.0 to 4.12.0 is vulnerable to an XSS attack due to the `ViewComponent::Base#around_render` method potentially returning HTML-unsafe strings, which can bypass standard escaping mechanisms. This vulnerability can be exploited when user-controlled data is processed, especially when combined with `ViewComponent::Collection#render_in`, leading to unsafe output being marked as safe. Developers using affected versions should prioritize upgrading to version 4.12.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied to normal #call return values. This creates an XSS risk when downstream applications use around_render to wrap, replace, instrument, or conditionally return content that includes user-controlled data, and ViewComponent::Collection#render_in can amplify the issue by joining per-item results and marking the entire output html_safe, converting raw unsafe output into an ActiveSupport::SafeBuffer. This issue is fixed in version 4.12.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)