Vendor
ViewComponent
5 known vulnerabilities.
Products
4 results · Clear filters · Feed
-
Medium 6.8
view_component: Reused Component Instances Retain Stale Render Context
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection,…
-
Medium 6.5
view_component: Preview Route Can Dispatch Inherited Helper Methods
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requ…
-
Medium 5.9
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved pa…
-
Medium 6.1
view_component Cross-site Scripting vulnerability
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component direct…