CVE-2024-21636

Summary

CVE-2024-21636 is a cross-site scripting (XSS) vulnerability affecting versions prior to 3.9.0 and 2.83.0 of the view_component framework in Ruby on Rails. This issue arises due to insufficient sanitization in the `#call` and `#output_postamble` methods, which can allow user-defined content to be injected into web pages. The vulnerability can impact users rendering a component directly from a controller using the view_component gem. To mitigate the issue, developers should upgrade to versions 3.9.0 and 2.83.0, or sanitize the return value of the `#call` method as a temporary workaround.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.