The ViewComponent Ruby gem has an XSS vulnerability in the around_render method of ViewComponent::Base. Unlike the call method, which escapes HTML-unsafe strings, around_render can return raw strings that bypass escaping. When used in collection rendering, the joined output is marked html_safe, causing unsafe user input to be rendered as trusted HTML. This discrepancy creates a security risk when around_render returns user-controlled content, allowing injection of malicious scripts. The vulnerability affects versions >=4.0.0 and <4.12.0. The root cause is that around_render return values are not processed by the __vc_maybe_escape_html method, unlike call outputs. This leads to inconsistent output safety and enables XSS attacks in applications that use around_render to wrap or modify rendered content.

Successful exploitation allows an attacker to inject arbitrary HTML and JavaScript into the rendered output of a ViewComponent, leading to cross-site scripting (XSS). This can compromise user sessions, steal sensitive information, or perform actions on behalf of users. The issue is particularly severe in collection rendering where multiple component outputs are concatenated and marked as html_safe, amplifying the risk. The vulnerability requires that the around_render method returns attacker-controlled data without proper escaping.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid returning user-controlled or unescaped data from the around_render method. Prefer using the call method for rendering user content or ensure explicit HTML escaping is applied to any data returned by around_render. Review usage of around_render in your components to prevent unsafe raw HTML output. Monitor the official ViewComponent repository and vendor advisories for patches or updates addressing this issue.