CVE-2026-54497

Name of the Vulnerable Software and Affected Versions view component versions 4.0.0 through 4.11.0

Description ViewComponent::Base instances retain render-scoped objects across calls to the render in() function. If the same component, collection, or spacer component instance is reused across different requests, users, tenants, or threads, subsequent renders may utilize stale data. This includes stale helpers, controller, request, view flow, format/variant details, and slot child context from a previous render.

This behavior can lead to several security issues, such as authorization-aware components rendering privileged UI for lower-privileged users, the generation of links using a stale Host header, and the leakage of slot or helper state. Additionally, it can cause request context mixing during concurrent rendering.

Technical details indicate that the issue stems from the memoization of request-scoped values using ||= or storage for later slot/collection rendering without a full reset of the render-scoped state at the start of each render. Specifically, the following variables are affected: vc original view context, @lookup context, @view flow, @ vc requested details, @ vc controller, @ vc helpers, and @ vc request.

Recommendations Update view component to version 4.12.0. As a temporary mitigation, avoid reusing the same component, collection, or spacer component instance across different render contexts; ensure a new instance is created for each render (e.g., using render(MyComponent.new(...))).