Secably Critical Vulnerabilities Found in Ruby on Rails ViewComponent Framework
Article Content
- •CVE-2026-54497 allows unauthorized UI rendering due to stale context retention.
- •CVE-2026-54498 poses a serious XSS risk with a CVSS score of 8.7.
- •Both vulnerabilities are patched in ViewComponent version 4.12.0.
Two vulnerabilities, CVE-2026-54497 and CVE-2026-54498, were published on July 17, 2026, affecting the Ruby on Rails ViewComponent framework versions 4.0.0 to 4.12.0. CVE-2026-54497 has a CVSS score of 6.8 and allows for resource exposure due to stale context being retained across renders, potentially leading to unauthorized UI rendering. CVE-2026-54498, with a CVSS score of 8.7, presents an XSS risk where unsafe HTML strings can bypass escaping, allowing for injection of malicious scripts. Both vulnerabilities are fixed in version 4.12.0. Users of the affected framework are urged to update immediately to mitigate risks. The EPSS indicates a significant likelihood of exploitation in the wild for both vulnerabilities.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-54497 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure On September 10, 2026, GitLab released patches for critical vulnerabilities CVE-2026-85706 and CVE-2026-87719. CVE-2026-85706, a path traversal flaw, allows unauthenticated users to read arbitrary files from GitLab servers, while CVE-2026-87719 enables credential theft via insecure deserialization. Both…