CVE-2026-44836 view_component: Preview Route Can Dispatch Inherited Helper Methods
Attackers can execute arbitrary code or read data by exploiting unsafe public_send calls in preview routes if previews are exposed.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44836?
CVE-2026-44836 is a medium-severity code injection vulnerability in ViewComponent view_component, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0.
Weakness: CWE-749
Which versions are affected by CVE-2026-44836?
2 open source packages ship an affected version, including view_component.
| Package | Affected | Fixed in |
|---|---|---|
view_component RubyGems | From 3.0.0 | 4.9.0 |
view_component RubyGems | From 3.0.0 | 4.9.0 |
How do I fix CVE-2026-44836?
Upgrade view_component to 4.9.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44836 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44836 exists.
Sources
Also known as DEBIAN-CVE-2026-44836, GHSA-7f3r-gwc9-2995, UBUNTU-CVE-2026-44836.