PT-2026-39302 · Viewcomponent+1 · View

Cyberlanc3R · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44836

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions view component versions 3.0.0 through 4.8.x

Description The preview route derives an example name from the URL and invokes it using public send without verifying if the requested method is an explicitly defined preview example. This allows inherited public methods on ViewComponent::Preview to be reachable via routes. Specifically, the render with template() function can be accessed, which accepts template: and locals: parameters. These values can be supplied via request parameters and passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable, potentially exposing secrets, configuration, debug data, or admin-only partials.

Recommendations Update view component to version 4.9.0. As a temporary workaround, restrict external access to preview routes to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-749

CWE-277

Related Identifiers

CVE-2026-44836

GHSA-7F3R-GWC9-2995

Affected Products

View

References · 5

• 🔥 https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/view_component/CVE-2026-44836.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44836 · Security Note
• https://osv.dev/vulnerability/GHSA-7f3r-gwc9-2995 · Vendor Advisory
• https://github.com/ViewComponent/view_component · Note