The view_component framework for Ruby on Rails versions from 3.0.0 up to but not including 4.9.0 has a vulnerability where the preview route derives an example name from the URL and calls it using public_send without verifying that the method is explicitly defined as a preview example. This allows route access to inherited public methods on ViewComponent::Preview, notably render_with_template, which accepts template and locals parameters from the request and passes them to Rails' render method. This can lead to rendering of internal Rails templates that are not otherwise accessible via routes. The vulnerability is addressed in version 4.9.0.

If preview routes are exposed, an attacker with at least low privilege (PR:L) can invoke internal rendering methods to access internal Rails templates, potentially disclosing sensitive information. The vulnerability has a CVSS score of 6.5 (medium severity) with network attack vector, low attack complexity, no user interaction required, and impacts confidentiality but not integrity or availability. There are no known exploits in the wild.

This vulnerability is fixed in view_component version 4.9.0. Users should upgrade to version 4.9.0 or later to remediate this issue. Since no official patch links or vendor advisories are provided, verify the upgrade and patch status with the official view_component release notes or repository. Until upgraded, restrict access to preview routes to trusted users only to reduce exposure.