https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T09:09:12.598384+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338960 EUVD-2026-338960 2026-10-09T09:09:12.645590+00:00 EUVD-2026-338960 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54498 fkie_cve-2026-54498 2026-10-09T09:09:12.645630+00:00

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied to normal #call return values. This creates an XSS risk when downstream applications use around_render to wrap, replace, instrument, or conditionally return content that includes user-controlled data, and ViewComponent::Collection#render_in can amplify the issue by joining per-item results and marking the entire output html_safe, converting raw unsafe output into an ActiveSupport::SafeBuffer. This issue is fixed in version 4.12.0.

 https://cve.radiocsirt.org/vuln/ghsa-97jw-64cj-jc58 GHSA-97jw-64cj-jc58 — ViewComponent: around_render HTML-Safety Bypass 2026-10-09T09:09:12.645666+00:00

Affected: RubyGems: view_component

## Summary

`ViewComponent::Base#around_render` can return HTML-unsafe strings that bypass the escaping behavior applied to normal `#call` return values. This creates an XSS risk when downstream applications use `around_render` to wrap, replace, instrument, or conditionally return content that includes user-controlled data.

The issue is especially dangerous in collection rendering because `ViewComponent::Collection#render_in` joins the per-item results and marks the entire output as `html_safe`, converting raw unsafe output into a trusted `ActiveSupport::SafeBuffer`.

## Affected Code

Validated against:

- Repository commit: `eea79445` - Ruby: `3.4.9`

Relevant locations:

- `lib/view_component/base.rb` - `render_in` - `around_render` - `__vc_maybe_escape_html` - `lib/view_component/template.rb` - `InlineCall#safe_method_name_call` - `lib/view_component/collection.rb` - `Collection#render_in`

Key code paths:

```ruby # lib/view_component/base.rb around_render do render_template_for(@__vc_requested_details).to_s end ```

```ruby # lib/view_component/template.rb proc do __vc_maybe_escape_html(send(m)) do Kernel.warn(...) end end ```

```ruby # lib/view_component/collection.rb components.map do |component| component.render_in(view_context, &block) end.join(rendered_spacer(view_context)).html_safe ```

## Root Cause

Normal inline `#call` output is passed through `__vc_maybe_escape_html`, which escapes HTML-unsafe strings. However, when `around_render`…