CVE-2026-54497

Katalog CVE

CVSS 6.8 · Medium EPSS 0,33%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada viewcomponent view component. Skor CVSS 3.1 6.8 (Medium) menurut github.com.

Deskripsi (NVD)

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. This issue is fixed in version 4.12.0.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

29 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-488: Exposure of Data Element to Wrong Session
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ViewComponent/view_component/security/advisories/GHSA-9h85-g7w3-rh49 exploit · mitigasi · advisory vendor
• https://github.com/ViewComponent/view_component/commit/6796b2e89d0bd7b9d7d763a86275e5334731dd61 patch
• https://github.com/ViewComponent/view_component/releases/tag/v4.12.0 product · release notes