AIKIDO-2026-419459

TL;DR

ViewComponent populates caller-provided slot state and with_content values on a component instance before render_in runs. The reset that guards reused instances clears controller, helpers, and request context but misses @__vc_set_slots and @__vc_content_set_by_with_content. When the same instance is reused across renders or requests through caching, pooling, or aliasing, one render's slot content and with_content value leak into a later render, exposing user-specific data across contexts. The fix reinstates a guard that raises when an instance is rendered more than once and rebuilds collection child and spacer components per render.