ViewComponent::Base#around_render, used in Ruby on Rails view components, can return strings that bypass the framework's normal escaping mechanism. From version 4.0.0 through 4.12.0, an attacker can supply user‑controlled data to around_render, causing the component to output raw, unsanitized HTML or JavaScript. This vulnerability is an instance of client‑side script injection (CWE‑79) and leads to cross‑site scripting (XSS) where malicious code can be executed in the context of trusted users' browsers, potentially exposing session data, credentials, or enabling further attacks.

The flaw affects the ViewComponent framework, specifically the view_component gem on Ruby on Rails. Vulnerable releases include versions from 4.0.0 until 4.12.0; the issue is resolved in v4.12.0. The gem's changelog indicates that around_render is now correctly marked safe only when explicitly required. Applications built with earlier gem versions, especially those that use around_render to wrap or replace content that incorporates user data or that employ ViewComponent::Collection#render_in for batch rendering, are at risk. Upgrading to the fixed version or applying the published patch is the recommended approach.

The CVSS score of 8.7 classifies the problem as high severity, yet the EPSS score is reported as < 1%, suggesting a low probability of current exploitation. The vulnerability is not listed in CISA's KEV catalog, and no active exploit code targeting this flaw has been documented. Nevertheless, the attack requires only that a user interacts with an affected Rails application, making it remotely exploitable via standard web requests. Security teams should treat this as a significant risk for any application that employs the vulnerable component patterns, particularly when handling sensitive user input.