{"id":"GHSA-wf2x-8w6j-qw37","summary":"view_component Cross-site Scripting vulnerability","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a [`#call` method](https://viewcomponent.org/guide/templates.html#call) (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content.\n\nIn addition, the return value of the [`#output_postamble` method](https://viewcomponent.org/api.html#output_postamble--string) is not sanitized, which can also lead to XSS issues.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nVersions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nSanitize the return value of `#call`, eg:\n\n```ruby\nclass MyComponent \u003c ApplicationComponent\n  def call\n    html_escape(\"\u003cdiv\u003e#{user_input}\u003c/div\u003e\")\n  end\nend\n```\n\n### References\n_Are there any links users can visit to find out more?_\n\nhttps://github.com/ViewComponent/view_component/pull/1950\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [github/view_component](https://github.com/github/view_component) project.","aliases":["CVE-2024-21636"],"modified":"2026-09-10T03:49:24.818621008Z","published":"2024-01-04T21:54:34Z","database_specific":{"nvd_published_at":"2024-01-04T20:15:25Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-01-04T21:54:34Z"},"references":[{"type":"WEB","url":"https://github.com/ViewComponent/view_component/security/advisories/GHSA-wf2x-8w6j-qw37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21636"},{"type":"WEB","url":"https://github.com/ViewComponent/view_component/pull/1950"},{"type":"WEB","url":"https://github.com/ViewComponent/view_component/pull/1962"},{"type":"WEB","url":"https://github.com/ViewComponent/view_component/commit/0d26944a8d2730ea40e60eae23d70684483e5017"},{"type":"WEB","url":"https://github.com/ViewComponent/view_component/commit/c43d8bafa7117cbce479669a423ab266de150697"},{"type":"PACKAGE","url":"https://github.com/ViewComponent/view_component"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/view_component/CVE-2024-21636.yml"}],"affected":[{"package":{"name":"view_component","ecosystem":"RubyGems","purl":"pkg:gem/view_component"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.9.0"}]}],"versions":["3.0.0","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-wf2x-8w6j-qw37/GHSA-wf2x-8w6j-qw37.json"}},{"package":{"name":"view_component","ecosystem":"RubyGems","purl":"pkg:gem/view_component"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.83.0"}]}],"versions":["1.16.0","1.17.0","2.0.0","2.1.0","2.10.0","2.11.0","2.11.1","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.18.0","2.18.1","2.18.2","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.20.0","2.21.0","2.22.0","2.22.1","2.23.0","2.23.1","2.23.2","2.24.0","2.25.0","2.25.1","2.26.0","2.26.1","2.27.0","2.28.0","2.29.0","2.3.0","2.30.0","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.37.0","2.38.0","2.39.0","2.4.0","2.40.0","2.41.0","2.42.0","2.43.0","2.43.1","2.44.0","2.45.0","2.46.0","2.47.0","2.48.0","2.49.0","2.49.1","2.5.0","2.5.1","2.50.0","2.51.0","2.52.0","2.53.0","2.54.0","2.54.1","2.55.0","2.56.0","2.56.1","2.56.2","2.57.0","2.57.1","2.58.0","2.59.0","2.6.0","2.60.0","2.61.0","2.61.1","2.62.0","2.63.0","2.64.0","2.65.0","2.66.0","2.67.0","2.68.0","2.69.0","2.7.0","2.70.0","2.71.0","2.72.0","2.73.0","2.74.0","2.74.1","2.75.0","2.76.0","2.77.0","2.78.0","2.79.0","2.8.0","2.80.0","2.81.0","2.82.0","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-wf2x-8w6j-qw37/GHSA-wf2x-8w6j-qw37.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}