ViewComponent Gem Vulnerability: Reused Instances Retain Stale Context
An early warning has been issued regarding a high severity vulnerability in the ViewComponent gem. Reportedly, reused component instances retain stale render context, which may lead to security issues such as unauthorized UI rendering and context mixing.
What happened
According to the advisory GHSA-9h85-g7w3-rh49, ViewComponent::Base instances retain multiple render-scoped objects across calls to `render_in`. This appears to cause several potential security issues, including authorization-aware components rendering privileged UI for lower-privileged users, generating links using a stale Host header, leaking slot/helper state, and mixing request context under concurrent rendering.
The vulnerability is under investigation, and it is recommended that users upgrade to the latest version of viewcomponent and review the usage of reused component instances in their applications to assess and mitigate potential exposure. Primary sources should be consulted for the most accurate and up-to-date information.
How 0Day mitigates this
viewcomponent is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.