GHSA-wf2x-8w6j-qw37 view_component Cross-site Scripting vulnerability

• RubyGems view_component: >= 3.0.0, < 3.9.0 → fixed in 3.9.0 • RubyGems view_component: < 2.83.0 → fixed in 2.83.0

Impact _What kind of vulnerability is it? Who is impacted?_ This is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` method is not sanitized, which can also lead to XSS issues. Patches _Has the problem been patched? What versions should users upgrade to?_ Versions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities. Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Sanitize the return value of `#call`, eg: ```ruby class MyComponent #{user_input}") end end ``` References _Are there any links users can visit to find out more?_ https://github.com/ViewComponent/view_component/pull/1950 For more information If you have any questions or comments about this advisory: Open an issue in the github/view_component project.