{"id":"CVE-2024-21636","aliases":["EUVD-2024-0446","GHSA-wf2x-8w6j-qw37"],"status":"published","title":"view_component Cross-site Scripting vulnerability","description":"view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00495,"percentile":0.42843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-01-04T20:09:08Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"RubyGems","package":"view_component","fixed_in":["3.9.0","2.83.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"view_component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.9.0"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"view_component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.83.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"view_component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.9.0"}]}],"versions":["3.0.0","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0"]},{"source":"osv","ecosystem":"RubyGems","package":"view_component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.83.0"}]}],"versions":["1.16.0","1.17.0","2.0.0","2.1.0","2.10.0","2.11.0","2.11.1","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.18.0","2.18.1","2.18.2","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.20.0","2.21.0","2.22.0","2.22.1","2.23.0","2.23.1","2.23.2","2.24.0","2.25.0","2.25.1","2.26.0","2.26.1","2.27.0","2.28.0","2.29.0","2.3.0","2.30.0","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.37.0","2.38.0","2.39.0","2.4.0","2.40.0","2.41.0","2.42.0","2.43.0","2.43.1","2.44.0","2.45.0","2.46.0","2.47.0","2.48.0","2.49.0","2.49.1","2.5.0","2.5.1","2.50.0","2.51.0","2.52.0","2.53.0","2.54.0","2.54.1","2.55.0","2.56.0","2.56.1","2.56.2","2.57.0","2.57.1","2.58.0","2.59.0","2.6.0","2.60.0","2.61.0","2.61.1","2.62.0","2.63.0","2.64.0","2.65.0","2.66.0","2.67.0","2.68.0","2.69.0","2.7.0","2.70.0","2.71.0","2.72.0","2.73.0","2.74.0","2.74.1","2.75.0","2.76.0","2.77.0","2.78.0","2.79.0","2.8.0","2.80.0","2.81.0","2.82.0","2.9.0"]}],"products":[{"vendor":"github","product":"view_component"},{"vendor":"viewcomponent","product":"view_component"}],"references":[{"url":"https://github.com/ViewComponent/view_component/security/advisories/GHSA-wf2x-8w6j-qw37","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/ViewComponent/view_component/pull/1950","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/ViewComponent/view_component/pull/1962","tags":["x_refsource_MISC","x_transferred","Issue Tracking","fix","web"]},{"url":"https://github.com/ViewComponent/view_component/commit/0d26944a8d2730ea40e60eae23d70684483e5017","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/ViewComponent/view_component/commit/c43d8bafa7117cbce479669a423ab266de150697","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21636","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/view_component/CVE-2024-21636.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wf2x-8w6j-qw37"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21636.json","tags":["advisory"]},{"url":"https://github.com/ViewComponent/view_component","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-21636","title":"view_component Cross-site Scripting vulnerability","description":"view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.","status":"published","published":"2024-01-04T20:09:08.564Z","modified":"2025-06-17T20:29:11.989Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:04.681315Z"}],"euvd":[{"id":"EUVD-2024-0446","description":"view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.","status":"published","published":"2024-01-04T20:09:08Z","modified":"2025-06-17T20:29:11Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:21.932311Z"}],"ghsa":[{"id":"GHSA-wf2x-8w6j-qw37","title":"view_component Cross-site Scripting vulnerability","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a [`#call` method](https://viewcomponent.org/guide/templates.html#call) (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content.\n\nIn addition, the return value of the [`#output_postamble` method](https://viewcomponent.org/api.html#output_postamble--string) is not sanitized, which can also lead to XSS issues.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nVersions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nSanitize the return value of `#call`, eg:\n\n```ruby\nclass MyComponent \u003c ApplicationComponent\n  def call\n    html_escape(\"\u003cdiv\u003e#{user_input}\u003c/div\u003e\")\n  end\nend\n```\n\n### References\n_Are there any links users can visit to find out more?_\n\nhttps://github.com/ViewComponent/view_component/pull/1950\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [github/view_component](https://github.com/github/view_component) project.","status":"published","published":"2024-01-04T21:54:34Z","modified":"2024-01-09T15:48:05Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:30.183224Z"}],"nvd":[{"id":"CVE-2024-21636","description":"view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.","status":"published","published":"2024-01-04T20:15:25.3Z","modified":"2026-06-17T07:09:53.78Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:30.070039Z"}],"osv":[{"id":"CVE-2024-21636","title":"view_component Cross-site Scripting vulnerability","description":"view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.","status":"published","published":"2024-01-04T20:09:08.564Z","modified":"2026-10-28T02:31:09.923066831Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-wf2x-8w6j-qw37","title":"view_component Cross-site Scripting vulnerability","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a [`#call` method](https://viewcomponent.org/guide/templates.html#call) (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content.\n\nIn addition, the return value of the [`#output_postamble` method](https://viewcomponent.org/api.html#output_postamble--string) is not sanitized, which can also lead to XSS issues.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nVersions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nSanitize the return value of `#call`, eg:\n\n```ruby\nclass MyComponent \u003c ApplicationComponent\n  def call\n    html_escape(\"\u003cdiv\u003e#{user_input}\u003c/div\u003e\")\n  end\nend\n```\n\n### References\n_Are there any links users can visit to find out more?_\n\nhttps://github.com/ViewComponent/view_component/pull/1950\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [github/view_component](https://github.com/github/view_component) project.","status":"published","published":"2024-01-04T21:54:34Z","modified":"2026-09-10T03:49:24.818621008Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.401149Z"}]}}