GEM · JULY 2026 · EARLY WARNING

ViewComponent around_render HTML-Safety Bypass: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
GHSA-97jw-64cj-jc58Severity: HIGH

An early warning has been issued regarding a potential vulnerability in the ViewComponent gem, where the around_render method may return HTML-unsafe strings, leading to an XSS risk.

What happened

Reportedly, the ViewComponent::Base#around_render method can return HTML-unsafe strings that bypass escaping, creating a cross-site scripting (XSS) risk. This issue appears to be particularly dangerous in scenarios involving collection rendering, where the entire output is marked as `html_safe`. The severity of this issue is under investigation, but it is currently classified as high due to the potential for XSS attacks.

Professional software engineers using ViewComponent are advised to assess their exposure by reviewing any usage of the around_render method for potential vulnerabilities. It is recommended to upgrade to a version of viewcomponent that includes the fix for this issue as soon as it becomes available. For more detailed information, consult the primary source at [GHSA-97jw-64cj-jc58](https://github.com/ViewComponent/view_component/security/advisories/GHSA-97jw-64cj-jc58).

At this stage, the exact versions affected and the specific fix are not yet confirmed. Engineers should stay updated by monitoring the official advisory and applying patches as soon as they are released. Further details on the nature and extent of the compromise should be obtained from the primary sources.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If viewcomponent is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats