view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2024-01-04T20:09:08.564Z
Updated: 2024-01-09T15:49:12.734Z
Reserved: 2023-12-29T03:00:44.957Z
Link: CVE-2024-21636
JSON object: View
NVD Information
Status : Analyzed
Published: 2024-01-04T20:15:25.300
Modified: 2024-01-10T15:45:31.947
Link: CVE-2024-21636
JSON object: View
Redhat Information
No data.
CWE