CVE-2026-54498

Name of the Vulnerable Software and Affected Versions view component versions 4.0.0 through 4.11.0

Description An issue exists where ViewComponent::Base#around render can return HTML-unsafe strings that bypass the escaping behavior typically applied to #call return values. This leads to a Cross-Site Scripting (XSS) risk when applications use around render to wrap, replace, or conditionally return content containing user-controlled data. The risk is amplified when using ViewComponent::Collection#render in, as it joins per-item results and marks the entire output as html safe, converting raw unsafe output into a trusted ActiveSupport::SafeBuffer. This behavior occurs because while normal inline #call output is processed by vc maybe escape html to escape unsafe strings, values returned by around render bypass this safety boundary.

Recommendations Update view component to version 4.12.0. As a temporary mitigation, avoid returning raw strings containing user-controlled data from the around render function. Restrict the use of ViewComponent::Collection#render in for components that utilize around render with dynamic content until the update is applied.