CVE-2024-27285

2024-02-2900:00:00

ubuntu.com

yard documentation tool

cross-site scripting

javascript sanitization

vulnerability fix

0.9.36

unix

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.9%

JSON

YARD is a Ruby Documentation tool. The “frames.html” file within the Yard
Doc’s generated documentation is vulnerable to Cross-Site Scripting (XSS)
attacks due to inadequate sanitization of user input within the JavaScript
segment of the “frames.erb” template file. This vulnerability is fixed in
0.9.36.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchyard< 0.9.12-2ubuntu0.1~esm1UNKNOWN
ubuntu20.04noarchyard< 0.9.24-1+deb11u1build0.20.04.1UNKNOWN
ubuntu22.04noarchyard< 0.9.26-1ubuntu0.1UNKNOWN
ubuntu23.10noarchyard< 0.9.28-2ubuntu0.1UNKNOWN
ubuntu16.04noarchyard< 0.8.7.6+git20160220-3ubuntu0.1~esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	yard	< 0.9.12-2ubuntu0.1~esm1	UNKNOWN
ubuntu	20.04	noarch	yard	< 0.9.24-1+deb11u1build0.20.04.1	UNKNOWN
ubuntu	22.04	noarch	yard	< 0.9.26-1ubuntu0.1	UNKNOWN
ubuntu	23.10	noarch	yard	< 0.9.28-2ubuntu0.1	UNKNOWN
ubuntu	16.04	noarch	yard	< 0.8.7.6+git20160220-3ubuntu0.1~esm1	UNKNOWN