view_component, a Ruby on Rails framework, allows rendering arbitrary previews via the preview route from versions 3.0.0 through 4.9.0. The route derives an example name from the URL and calls it with public_send without checking whether the method exists in the preview class. An attacker can invoke inherited public methods such as render_with_template, which accepts template and locals parameters from the request. Those values are later passed to Rails as render template, enabling the attacker to render internal Rails templates that are otherwise not routable, potentially exposing sensitive information or code execution vectors.

The vulnerability affects the ViewComponent library for Ruby on Rails. All releases between 3.0.0 and 4.9.0 are affected. The issue was resolved in version 4.9.0. No other vendors or products are listed.

The CVSS score of 6.5 indicates medium severity, while no EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a crafted HTTP request to the preview route, which an attacker can use if previews are exposed to the public. Successful exploitation would allow rendering of arbitrary internal templates, leading to information disclosure or potential code execution, depending on the template contents.