The vulnerability in ViewComponent (RubyGems) arises because instances of ViewComponent::Base retain multiple render-scoped objects such as helpers, controller, request, view_flow, and slot child context across calls to render_in. When the same component instance is reused across requests, users, tenants, or threads, stale context from earlier renders can be used in later renders. This leads to authorization-aware components potentially rendering privileged UI for lower-privileged users, generating links with stale Host headers, leaking slot/helper state, and mixing request context under concurrent rendering. The root cause is that component instances are mutable and memoize request-scoped values using ||= or store them for later rendering without a full reset at the start of each render. The runtime does not enforce the invariant that component instances should not be shared between renders. The vulnerability affects versions >=4.0.0 and <4.12.0. The CVSS vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N with a moderate severity rating. No patch or official fix is currently available.

This vulnerability can lead to cross-user authorization issues where privileged UI elements are rendered for unauthorized users due to stale authorization context. It can also cause generation of URLs with stale Host headers, leakage of slot and helper state, and mixing of request context in concurrent rendering scenarios. These impacts can compromise confidentiality and integrity of user interface rendering and data exposure in affected applications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid reusing component instances across requests, users, or threads. Ensure that component instances are not shared and are freshly instantiated per render to prevent stale context retention. Follow any updates from the maintainers regarding enforcement of instance reuse invariants or official patches.