The view_component framework for Ruby on Rails versions 3.0.0 to before 4.9.0 has a vulnerability where the preview route uses public_send to call methods derived from the URL without verifying that the method is explicitly defined as a preview example. This allows inherited public methods on ViewComponent::Preview, such as render_with_template, to be invoked via the route. Since render_with_template accepts template and locals parameters from the request and passes them to Rails' render template functionality, an attacker can render internal templates that are otherwise not routable. This vulnerability is addressed in version 4.9.0.

If previews are exposed, an attacker with at least low privileges can invoke internal rendering methods to access and render internal Rails templates that are not intended to be publicly accessible. This can lead to unauthorized disclosure of internal template content. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

This vulnerability is fixed in view_component version 4.9.0. Users should upgrade to version 4.9.0 or later to remediate this issue. Since no official patch or temporary fix details are provided beyond the version fix, upgrading is the recommended action. If upgrading is not immediately possible, restricting access to preview routes to trusted users or disabling preview routes can reduce exposure.