CVE-2024-21636: view_component Cross-site Scripting vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-04 · updated 2026-06-17
Weakness: CWE-79

Description

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.

Affected products

ViewComponent view_component: before 2.83.0; from 3.0.0 before 3.9.0 — fixed in 2.83.0, 3.9.0

How to fix

Upgrade to a fixed version: ViewComponent view_component 2.83.0, 3.9.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21636 or the next vulnerability affects your stack