Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

yard

5 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 3 medium
Registry
RubyGems

Advisories 5

  • CVE-2026-49342Medium 5.3

    YARD static cache reads raw traversal paths before router sanitization

    Affected: fixed in 0.9.44.

  • CVE-2026-41493Medium 6.9

    yard: Possible arbitrary path traversal and file access via yard server

    Affected: fixed in 0.9.42.

  • CVE-2024-27285Medium 5.4

    YARD's default template vulnerable to Cross-site Scripting in generated frames.html

    Affected: fixed in 0.9.36.

  • yard before 0.9.20 allows path traversal.

    Affected: fixed in 0.9.20.

  • lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows…

    Affected: fixed in 0.9.11.