Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54497— view_component: Reused Component Instances Retain Stale Render Context

Quick assessment

Affected
ViewComponent view_component
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

viewcomponent view_component是viewcomponent个人开发者的消息队列中间件。 ViewComponent 4.0.0版本至4.12.0之前版本存在安全漏洞，该漏洞源于ViewComponent::Base实例在render_in调用间保留渲染作用域对象，导致在相同组件、集合或间隔组件实例跨请求、用户、租户或线程重用时，后续渲染可能使用过时的辅助方法、控制器、请求、view_flow、格式/变体详情及插槽子环境，可能造成授权感知组件为低权限用户渲染特权UI、使用过时Hos

CVSS 6.8 · Medium EPSS 0.33% · P24

Possible ATT&CK Techniques 2 AI

T1562 T1133 · External Remote Services

Affected Version Matrix 1

VendorProduct Version RangeStatus
ViewComponent view_component >= 4.0.0, < 4.12.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54497

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
view_component: Reused Component Instances Retain Stale Render Context
Source: CVE Program / CVE List V5
Vulnerability Description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. This issue is fixed in version 4.12.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Vulnerability Title
ViewComponent 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
viewcomponent view_component是viewcomponent个人开发者的消息队列中间件。 ViewComponent 4.0.0版本至4.12.0之前版本存在安全漏洞，该漏洞源于ViewComponent::Base实例在render_in调用间保留渲染作用域对象，导致在相同组件、集合或间隔组件实例跨请求、用户、租户或线程重用时，后续渲染可能使用过时的辅助方法、控制器、请求、view_flow、格式/变体详情及插槽子环境，可能造成授权感知组件为低权限用户渲染特权UI、使用过时Hos
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ViewComponent view_component >= 4.0.0, < 4.12.0 -

II. Public POCs for CVE-2026-54497

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54497

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54497 (1)

Vendor Advisories for CVE-2026-54497 (1)

Vendor Pages for CVE-2026-54497 (1)

IV. Related Vulnerabilities

Same product: view_component
Same vendor: ViewComponent
Same weakness: CWE-362

V. Comments for CVE-2026-54497

No comments yet

Leave a comment