WARNING: The #{self.class} component's around_render returne

Error message

WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate.

What it means

Error "WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate." thrown in ViewComponent/view_component.

Source

Thrown at lib/view_component/base.rb:462

        html_escape(text)
      end
    end

    def __vc_safe_output_preamble
      __vc_maybe_escape_html(output_preamble) do
        Kernel.warn("WARNING: The #{self.class} component was provided an HTML-unsafe preamble. The preamble will be automatically escaped, but you may want to investigate.")
      end
    end

    def __vc_safe_output_postamble
      __vc_maybe_escape_html(output_postamble) do
        Kernel.warn("WARNING: The #{self.class} component was provided an HTML-unsafe postamble. The postamble will be automatically escaped, but you may want to investigate.")
      end
    end

    def __vc_safe_around_render_output(output)
      __vc_maybe_escape_html(output) do
        Kernel.warn("WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate.")
      end
    end

    # Resets every render-scoped instance variable derived from the calling view
    # context so a reused instance cannot leak controller/helper/request/format
    # state from a previous render. Slot state (`@__vc_set_slots`,
    # `@__vc_content_set_by_with_content`) is intentionally preserved because it
    # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
    # slot setters or `with_content`).
    RENDER_STATE_IVARS = %i[
      @__vc_controller
      @__vc_helpers
      @__vc_request
    ].freeze

    def __vc_reset_render_state!
      RENDER_STATE_IVARS.each do |ivar|
        remove_instance_variable(ivar) if instance_variable_defined?(ivar)

View on GitHub (pinned to 9f22c36fa7)

Solutions

In `around_render`, escape untrusted interpolations with `ERB::Util.html_escape` (or `h`) and mark the final trusted string `.html_safe` before returning it.
Alternatively build the output with `content_tag` or `safe_join` so escaping is handled for you.

When it happens

Trigger: Thrown at lib/view_component/base.rb:462 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ViewComponent/view_component@9f22c36fa7 (2026-08-23). Data as JSON: /api/errors/5334dbe38715a32d. Report an issue: GitHub.