CVE-2026-44836

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44836", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:21:48.352Z", "datePublished": "2026-05-26T19:43:58.008Z", "dateUpdated": "2026-05-27T13:21:54.259Z"}, "containers": {"cna": {"title": "view_component: Preview Route Can Dispatch Inherited Helper Methods", "problemTypes": [{"descriptions": [{"cweId": "CWE-749", "lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995"}], "affected": [{"vendor": "ViewComponent", "product": "view_component", "versions": [{"version": ">= 3.0.0, < 4.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T19:43:58.008Z"}, "descriptions": [{"lang": "en", "value": "view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0."}], "source": {"advisory": "GHSA-7f3r-gwc9-2995", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T13:21:32.395983Z", "id": "CVE-2026-44836", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:21:54.259Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44836", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T13:21:32.395983Z"}}}], "references": [{"url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:21:50.362Z"}}], "cna": {"title": "view_component: Preview Route Can Dispatch Inherited Helper Methods", "source": {"advisory": "GHSA-7f3r-gwc9-2995", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ViewComponent", "product": "view_component", "versions": [{"status": "affected", "version": ">= 3.0.0, < 4.9.0"}]}], "references": [{"url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995", "name": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T19:43:58.008Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44836", "state": "PUBLISHED", "dateUpdated": "2026-05-27T13:21:54.259Z", "dateReserved": "2026-05-07T21:21:48.352Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T19:43:58.008Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "view_component", "vendor": "ViewComponent", "versions": [{"status": "affected", "version": ">= 3.0.0, < 4.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0."}, {"lang": "es", "value": "view_component es un framework para construir componentes de vista reutilizables, testeables y encapsulados en Ruby on Rails. Desde la versi\u00f3n 3.0.0 hasta la 4.9.0, la ruta de previsualizaci\u00f3n (preview route) deriva un nombre de ejemplo de la URL y lo invoca con public_send. El c\u00f3digo no verifica que el m\u00e9todo solicitado sea uno de los ejemplos de previsualizaci\u00f3n definidos expl\u00edcitamente por la clase de previsualizaci\u00f3n (preview class). Como resultado, los m\u00e9todos p\u00fablicos heredados en ViewComponent::Preview son accesibles a trav\u00e9s de la ruta (route-reachable). El m\u00e1s importante es render_with_template, que acepta template: y locals:. Esos valores pueden provenir de los par\u00e1metros de la solicitud (request params) y luego se pasan a Rails como render template:. Si las previsualizaciones (previews) est\u00e1n expuestas, un atacante puede renderizar plantillas internas de Rails que de otro modo no ser\u00edan enrutables. Esta vulnerabilidad se corrige en la versi\u00f3n 4.9.0."}], "id": "CVE-2026-44836", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44836", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T13:21:32.395983Z", "version": "2.0.3"}}]}, "published": "2026-05-26T21:16:38.710", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-749"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,4.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "view_component", "source": "cna", "vendor": "ViewComponent"}, "product": "view_component", "vendor": "viewcomponent"}], "created": "2026-05-26T21:30:16.145323+00:00", "updated": "2026-05-26T21:30:16.445738+00:00", "vendors": ["viewcomponent", "viewcomponent$PRODUCT$view_component"]}