Updated advisory posts against rubysec/ruby-advisory-db@6471a8b

Author: jasnow

advisories/_posts/2026-06-04-CVE-2026-54497.md

@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2026-54497 (view_component): Reused Component Instances Retain Stale Render
+  Context'
+comments: false
+categories:
+- view_component
+advisory:
+  gem: view_component
+  cve: 2026-54497
+  ghsa: 9h85-g7w3-rh49
+  url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54497
+  title: Reused Component Instances Retain Stale Render Context
+  date: 2026-06-04
+  description: |-
+    ## Summary
+
+    ViewComponent::Base instances retain multiple render-scoped objects
+    across calls to render_in. If the same component, collection, or
+    spacer component instance is reused across requests, users, tenants,
+    or threads, later renders can use stale helpers, controller, request,
+    view_flow, format/variant details, and slot child context from an
+    earlier render.
+
+    This can cause authorization-aware components to render privileged UI
+    for a lower-privileged user, generate links using a stale Host header,
+    leak slot/helper state, and mix request context under concurrent rendering.
+  cvss_v3: 6.8
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - ">= 4.12.0"
+  related:
+    url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54497
+    - https://github.com/ViewComponent/view_component/releases/tag/v4.12.0
+    - https://github.com/ViewComponent/view_component/security/advisories/GHSA-9h85-g7w3-rh49
+  notes: |
+    - cvss_v3 came from GHSA.
+    - CVE is reserved, but not published so no non-GHSA cvss values.
+---

advisories/_posts/2026-06-04-CVE-2026-54498.md

@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2026-54498 (view_component): around_render HTML-Safety Bypass'
+comments: false
+categories:
+- view_component
+advisory:
+  gem: view_component
+  cve: 2026-54498
+  ghsa: 97jw-64cj-jc58
+  url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54498
+  title: around_render HTML-Safety Bypass
+  date: 2026-06-04
+  description: |-
+    ## Summary
+
+    ViewComponent::Base#around_render can return HTML-unsafe strings that
+    bypass the escaping behavior applied to normal #call return values.
+    This creates an XSS risk when downstream applications use around_render
+    to wrap, replace, instrument, or conditionally return content that
+    includes user-controlled data.
+
+    The issue is especially dangerous in collection rendering because
+    ViewComponent::Collection#render_in joins the per-item results and
+    marks the entire output as html_safe, converting raw unsafe
+    output into a trusted ActiveSupport::SafeBuffer.
+  cvss_v3: 8.7
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - ">= 4.12.0"
+  related:
+    url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54498
+    - https://github.com/ViewComponent/view_component/releases/tag/v4.12.0
+    - https://github.com/ViewComponent/view_component/security/advisories/GHSA-97jw-64cj-jc58
+  notes: |
+    - cvss_v3 came from GHSA.
+    - CVE is reserved, but not published so no non-GHSA cvss values.
+---