AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-17T21:17:09.043Z and has not been modified since then. This high-severity vulnerability affects ViewComponent in Ruby on Rails applications, specifically versions 4.0.0 until 4.12.0. The vulnerability class is related to ViewComponent::Base#around_render returning HTML-unsafe strings, creating an XS [truncated]
CVE-2026-54497 is a medium-severity vulnerability affecting ViewComponent, a framework for building reusable view components in Ruby on Rails. The vulnerability causes ViewComponent::Base instances to retain render-scoped objects across calls to render_in, potentially leading to authorization issues, stale data, and security risks. This issue may allow attackers to exploit the vulnerability to gain unauth [truncated]
## Summary view_component versions 3.0.0 through 4.9.0 contain a path traversal vulnerability in the system test entrypoint. The application uses `File.realpath` to canonicalize a user-controlled file path, then performs a prefix-based check against the temp directory path. This containment check is unsafe because sibling directories can share the same string prefix, allowing an attacker to access files o [truncated]
CVE-2026-44836 is a medium-severity vulnerability in the view_component Ruby gem affecting versions 3.0.0 through 4.9.0. The issue stems from improper method authorization in the preview route functionality. When preview routes are enabled, the application derives an example name from the URL and invokes it via public_send without verifying that the requested method is explicitly defined as a preview exam [truncated]
