EUVD-2026-338858

fkie_cve-2026-54497

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. This issue is fixed in version 4.12.0.

GHSA-9h85-g7w3-rh49 — ViewComponent: Reused Component Instances Retain Stale Render Context

Affected: RubyGems: view_component

# Reused Component Instances Retain Stale Render Context

## Summary

`ViewComponent::Base` instances retain multiple render-scoped objects across calls to `render_in`. If the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale `helpers`, `controller`, `request`, `view_flow`, format/variant details, and slot child context from an earlier render.

This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering.

## Severity

The PoC demonstrates cross-user authorization impact in a realistic downstream application pattern. If the receiving program accepts downstream cross-user authorization impact as a scope-changing impact for a framework vulnerability, an alternative High score can be assigned:

Alternative CVSS: 8.2 Alternative vector: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N`

## Affected Code

Validated against:

- Repository commit: `eea79445` - Ruby: `3.4.9`

Relevant locations:

- `lib/view_component/base.rb` - `render_in` - `controller` - `helpers` - `__vc_request` - `lib/view_component/slot.rb` - `Slot#to_s` - `lib/view_component/slotable.rb` - slot storage in `@__vc_set_slots` - `lib/view_component/collection.rb` - child component memoization and spacer rendering

Key retained state:

```ruby @view_context = vi…

Most recent entries from all

EUVD-2026-338858

fkie_cve-2026-54497

GHSA-9h85-g7w3-rh49 — ViewComponent: Reused Component Instances Retain Stale Render Context