The view_component framework for Ruby on Rails versions >=4.0.0 and <4.12.0 contains an XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, ViewComponent::Base#around_render may return HTML-unsafe strings that bypass escaping, and ViewComponent::Collection#render_in can amplify this by joining per-item results and marking the entire output as html_safe, converting unsafe raw output into an ActiveSupport::SafeBuffer. This can lead to cross-site scripting when user-controlled data is included in the around_render output. The vulnerability is resolved in version 4.12.0.

Successful exploitation can lead to cross-site scripting attacks, allowing an attacker to execute arbitrary scripts in the context of the vulnerable application. This can result in compromise of user sessions, defacement, or redirection to malicious sites. The CVSS v3.1 score is 8.7 (high), indicating a significant risk with network attack vector, low attack complexity, requiring low privileges and user interaction, with impact on confidentiality and integrity but not availability.

Upgrade to view_component version 4.12.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 4.12.0.