darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby…
Priority LOW 26CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 5 fixed, 3 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Why it matters now
EPSS 0.02992 87th percentileScored 2026-11-07
Fix Partial rdoc (RubyGems): 3.12.1Red Hat: 4 advisoriesRed Hat: 5 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rdoc (RubyGems) | 2.3.0 to before 3.12.1 | 3.12.1 | Patch available | GHSA-v2r9-c84j-v7xm |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rdoc (RubyGems) Vendor— Affected 2.3.0 to before 3.12.1 Fixed in 3.12.1 Patch available GHSA-v2r9-c84j-v7xm
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby-lang:rdoc:*:*:*:*:*:ruby:*:* | 2.3.0 to before 3.12 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:rdoc:4.0.0:preview2:*:*:*:ruby:*:* | 4.0.0 preview2 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* | 1.9 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* | 1.9.1 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* | 1.9.2 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* | 1.9.3 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* | 1.9.3 p0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* | 1.9.3 p125 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* | 1.9.3 p194 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:* | 1.9.3 p286 | Vulnerable | ruby |
- cpe:2.3:a:ruby-lang:rdoc:*:*:*:*:*:ruby:*:* Versions 2.3.0 to before 3.12 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:rdoc:4.0.0:preview2:*:*:*:ruby:*:* Versions 4.0.0 preview2 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* Versions 1.9.3 p0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* Versions 1.9.3 p125 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* Versions 1.9.3 p194 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:* Versions 1.9.3 p286 Vulnerable ·ruby
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:* | 1.9.3 p383 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* | 2.0.0 rc2 | Vulnerable | ruby |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* | 12.10 | Vulnerable | Canonical |
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:* Versions 1.9.3 p383 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·ruby
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
Remediation
- Fix · GHSA-v2r9-c84j-v7xm rdoc (RubyGems) Fixed in 3.12.1 Advisory →
Red Hat 4 advisories
- RHSA-2013:0728 Released 2013-04-09 · Red Hat rating Moderaterubygem packages security update
- Red Hat OpenShift Enterprise Infrastructure ruby193-rubygem-activesupport-1:3.2.8-4.el6, ruby193-rubygem-bcrypt-ruby-3.0.1-7.el6, ruby193-rubygem-bson-1.5.2-6.el6op +11
- Red Hat OpenShift Enterprise Node ruby193-rubygem-activesupport-1:3.2.8-4.el6, ruby193-rubygem-bcrypt-ruby-3.0.1-7.el6, ruby193-rubygem-bson-1.5.2-6.el6op +7
- RHSA-2013:0701 Released 2013-04-02 · Red Hat rating Moderateruby193-ruby, rubygem-json and rubygem-rdoc security update
- Red Hat OpenShift Enterprise Infrastructure ruby193-ruby-1.9.3.327-28.el6, ruby193-ruby-devel-1.9.3.327-28.el6, ruby193-ruby-doc-1.9.3.327-28.el6 +15
- Red Hat OpenShift Enterprise Node ruby193-ruby-1.9.3.327-28.el6, ruby193-ruby-devel-1.9.3.327-28.el6, ruby193-ruby-doc-1.9.3.327-28.el6 +13
- RHSA-2013:0686 Released 2013-03-26 · Red Hat rating ModerateSubscription Asset Manager 1.2.1 update
- Red Hat Subscription Asset Manager for RHEL 6 Server candlepin-0.7.24-1.el6_3, candlepin-devel-0.7.24-1.el6_3, candlepin-selinux-0.7.24-1.el6_3 +23
Show 1 more Red Hat advisories
- RHSA-2013:0548 Released 2013-02-21 · Red Hat rating ModerateCloudForms Common 1.1.2 update
- CloudForms Cloud Engine for RHEL 6 Server ruby-nokogiri-1.5.0-0.9.beta4.el6cf, rubygem-activesupport-1:3.0.10-10.el6cf, rubygem-delayed_job-2.1.4-3.el6cf +14
- CloudForms System Engine for RHEL 6 Server ruby-nokogiri-1.5.0-0.9.beta4.el6cf, rubygem-activesupport-1:3.0.10-10.el6cf, rubygem-delayed_job-2.1.4-3.el6cf +10
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Enterprise 1 | Affected | No fix yet |
| Red Hat Enterprise MRG 2 | Affected | No fix yet |
| Red Hat Subscription Asset Manager | Affected | No fix yet |
| CloudForms Cloud Engine for RHEL 6 Server | Fixed | RHSA-2013:0548 |
| CloudForms System Engine for RHEL 6 Server | Fixed | RHSA-2013:0548 |
| Red Hat OpenShift Enterprise Infrastructure | Fixed | RHSA-2013:0701, RHSA-2013:0728 |
| Red Hat OpenShift Enterprise Node | Fixed | RHSA-2013:0701, RHSA-2013:0728 |
| Red Hat Subscription Asset Manager for RHEL 6 Server | Fixed | RHSA-2013:0686 |
Timeline
- 2026-10-02 Threatist record created from CVE-2013-0256
- 2026-10-03 Alias added: GHSA-v2r9-c84j-v7xm
References
Advisory 12
- RHSA-2013:0701
- http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/
- openSUSE-SU-2013:0303
- http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2
- RHSA-2013:0728
- RHSA-2013:0686
- https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60
- RHSA-2013:0548
- USN-1733-1
- SUSE-SU-2013:0647
- https://nvd.nist.gov/vuln/detail/CVE-2013-0256
- https://github.com/advisories/GHSA-v2r9-c84j-v7xm
Other 5
- https://bugzilla.redhat.com/show_bug.cgi?id=907820
- https://github.com/rdoc/rdoc
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2013-0256.yml
- https://web.archive.org/web/20130402173730/http://blog.segment7.net:80/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2
- http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256
Sources
- CVE-2013-0256 · CVE Program
- CVE-2013-0256 · NVD
- FIRST EPSS
- GHSA-v2r9-c84j-v7xm · GitHub Advisory Database · CC BY 4.0
- CVE-2013-0256 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences