TI-2024-18124 CVE-2024-27285 · GHSA-8mq4-9jjh-9xrc
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
Priority MEDIUM 60
YARD is a Ruby Documentation tool.
Yardoc
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Yardoc records in CISA KEVNo Yardoc vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records in Yard · all components
TI-2017-12509 CVE-2017-17042 · GHSA-gj4p-3wh3-2rmf
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative…
Priority LOW 38
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
TI-2026-30080 CVE-2026-41493 · GHSA-3jfp-46x4-xgfj
yard: Possible arbitrary path traversal and file access via yard server
Priority LOW 37
YARD is a Ruby Documentation tool.
TI-2019-16079 CVE-2019-1020001 · GHSA-xfhh-rx56-rxcr
yard before 0.9.20 allows path traversal.
Priority LOW 37
yard before 0.9.20 allows path traversal.