TI-2026-30080 CVE-2026-41493 · GHSA-3jfp-46x4-xgfj
yard: Possible arbitrary path traversal and file access via yard server
Priority LOW 37
YARD is a Ruby Documentation tool.
Vulnerabilities
4 records
TI-2024-18124 CVE-2024-27285 · GHSA-8mq4-9jjh-9xrc
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
Priority MEDIUM 60
YARD is a Ruby Documentation tool.
TI-2019-16079 CVE-2019-1020001 · GHSA-xfhh-rx56-rxcr
yard before 0.9.20 allows path traversal.
Priority LOW 37
yard before 0.9.20 allows path traversal.
TI-2017-12509 CVE-2017-17042 · GHSA-gj4p-3wh3-2rmf
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative…
Priority LOW 38
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.