view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on     Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with     public_send. The code does not verify that the requested method is one of the preview examples explicitly     defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-     reachable. The most important one is render_with_template, which accepts template: and locals:. Those     values can come from request params and are later passed to Rails as render template:. If previews are     exposed, an attacker can render internal Rails templates that are not otherwise routable. This     vulnerability is fixed in 4.9.0. (CVE-2026-44836)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on
    Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with
    public_send. The code does not verify that the requested method is one of the preview examples explicitly
    defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-
    reachable. The most important one is render_with_template, which accepts template: and locals:. Those
    values can come from request params and are later passed to Rails as render template:. If previews are
    exposed, an attacker can render internal Rails templates that are not otherwise routable. This
    vulnerability is fixed in 4.9.0. (CVE-2026-44836)

ID	Name	Product	Family	Severity
317991	Linux Distros Unpatched Vulnerability : CVE-2026-44836	Nessus	Misc.	medium
441576	SCA: security update for view_component (GHSA-7f3r-gwc9-2995)	Tenable Cloud Security	SCA Checks	medium
441576	SCA: security update for view_component (GHSA-7f3r-gwc9-2995)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-44836

medium

Tenable Plugins

medium

medium

medium