Description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ViewComponent | view_component | >= 3.0.0, < 4.9.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-view-component | 4.12.0-1 | — |
| Debian 12 | ruby-view-component | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-view-component | No fix yet | — |
| Ubuntu 24.04 LTS | ruby-view-component | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | view_component | >= 3.0.0, < 4.9.0 | 4.9.0 | GHSA-hg3h-g7xc-f7vp |