AIKIDO-2026-10779
view_component is vulnerable to Improper Access Control
65
Medium Risk
This Affects:
view_componentTL;DR
The preview route derives an example method name from the URL and dispatches it without restricting calls to explicitly declared preview examples. Inherited public methods on ViewComponent::Preview, including helper methods that render arbitrary templates with supplied locals, can be invoked through preview URLs. This can expose internal templates and request-derived data when preview routes are exposed. The fix enforces an allowlist of declared examples and raises AbstractController::ActionNotFound for undeclared method names.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
view_component is vulnerable to Improper Access Control in versions 3.0.0 - 4.8.0.
How to fix this
Upgrade the view_component library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.