CVE-2024-21636

CVE-2024-21636 affects the ViewComponent framework for Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 allow cross-site scripting when a component defines a #call method and returns unescaped content, and when #output_postamble also returns unescaped content. The vulnerability applies to render...

CVE-2026-54497

CVE-2026-54497 (ViewComponent, Ruby on Rails) : Affected through ViewComponent::Base from 4.0.0 to 4.11.x where render_in can retain render-scoped objects across invocations. Reusing the same component instance (or collection/spacer) across requests/threads can cause stale request context, helper...