AIKIDO-2026-10779
view_component is vulnerable to Improper Access Control
65
Medium Risk
This Affects:
view_componentTL;DR
The preview route derives an example method name from the URL and dispatches it without restricting calls to explicitly declared preview examples. Inherited public methods on ViewComponent::Preview, including helper methods that render arbitrary templates with supplied locals, can be invoked through preview URLs. This can expose internal templates and request-derived data when preview routes are exposed. The fix enforces an allowlist of declared examples and raises AbstractController::ActionNotFound for undeclared method names.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
view_component is vulnerable to Improper Access Control in versions 3.0.0 - 4.8.0.
How to fix this
Upgrade the view_component library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant