CVE-2024-27285

2024-02-2820:15:41

Debian Security Bug Tracker

security-tracker.debian.org

yard

ruby

documentation

xss

vulnerability

patched

0.0004 Low

EPSS

Percentile

9.9%

JSON

YARD is a Ruby Documentation tool. The “frames.html” file within the Yard Doc’s generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the “frames.erb” template file. This vulnerability is fixed in 0.9.36.

OSVersionArchitecturePackageVersionFilename
Debian12allyard< 0.9.28-2+deb12u2yard_0.9.28-2+deb12u2_all.deb
Debian11allyard< 0.9.24-1+deb11u1yard_0.9.24-1+deb11u1_all.deb
Debian10allyard< 0.9.16-1+deb10u1yard_0.9.16-1+deb10u1_all.deb
Debian999allyard< 0.9.36-1yard_0.9.36-1_all.deb
Debian13allyard< 0.9.36-1yard_0.9.36-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	yard	< 0.9.28-2+deb12u2	yard_0.9.28-2+deb12u2_all.deb
Debian	11	all	yard	< 0.9.24-1+deb11u1	yard_0.9.24-1+deb11u1_all.deb
Debian	10	all	yard	< 0.9.16-1+deb10u1	yard_0.9.16-1+deb10u1_all.deb
Debian	999	all	yard	< 0.9.36-1	yard_0.9.36-1_all.deb
Debian	13	all	yard	< 0.9.36-1	yard_0.9.36-1_all.deb

0.0004 Low

EPSS

Percentile

9.9%

JSON

Related for DEBIANCVE:CVE-2024-27285