« Volver al listado

CVE-2026-44836

Estado: AplazadaMedia (6.5)—

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Viewcomponent — View ComponentAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-44836",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44836",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-27T13:21:32.395983Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "ViewComponent",
          "product": "view_component",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 4.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T21:16:38.710",
  "references": [
    {
      "url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-7f3r-gwc9-2995",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0."
    },
    {
      "lang": "es",
      "value": "view_component es un framework para construir componentes de vista reutilizables, testeables y encapsulados en Ruby on Rails. Desde la versión 3.0.0 hasta la 4.9.0, la ruta de previsualización (preview route) deriva un nombre de ejemplo de la URL y lo invoca con public_send. El código no verifica que el método solicitado sea uno de los ejemplos de previsualización definidos explícitamente por la clase de previsualización (preview class). Como resultado, los métodos públicos heredados en ViewComponent::Preview son accesibles a través de la ruta (route-reachable). El más importante es render_with_template, que acepta template: y locals:. Esos valores pueden provenir de los parámetros de la solicitud (request params) y luego se pasan a Rails como render template:. Si las previsualizaciones (previews) están expuestas, un atacante puede renderizar plantillas internas de Rails que de otro modo no serían enrutables. Esta vulnerabilidad se corrige en la versión 4.9.0."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}