GHSA-9h85-g7w3-rh49: ViewComponent: Reused Component Instances Retain Stale Render Context

Reused Component Instances Retain Stale Render Context Summary ViewComponent::Base instances retain multiple render-scoped objects across calls to render_in. If the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. Severity The PoC demonstrates cross-user authorization impact in a realistic downstream application pattern. If the receiving program accepts downstream cross-user authorization impact as a scope-changing impact for a framework vulnerability, an alternative High score can be assigned: Alternative CVSS: 8.2 Alternative vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N Affected Code Validated against: - Repository commit: eea79445 - Ruby: 3.4.9 Relevant locations: - lib/view_component/base.rb - render_in - controller - helpers - __vc_request - lib/view_component/slot.rb - Slot#to_s - lib/view_component/slotable.rb - slot storage in @__vc_set_slots - lib/view_component/collection.rb - child component memoization and spacer rendering Key retained state: @view_context = view_context self.__vc_original_view_context ||= view_context @lookup_context ||= view_context.lookup_context @view_flow ||= view_context.view_flow @__vc_requested_details ||= @lookup_context.vc_requested_details @__vc_controller ||= view_context.controller @__vc_helpers ||= __vc_original_view_context || controller.view_context @__vc_request ||= controller.request if controller.respond_to?(:request) Slot children also inherit the parent original view context: @__vc_component_instance.__vc_original_view_context = @parent.__vc_original_view_context Collections memoi