Approved changes feed: RSS · Atom
cpe:2.3:a:lsegal:yard:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Lsegal (8c9442a8-dace-5362-bbfc-88756e125fa3) |
|---|---|
| Product | Yard (9d5ae568-0cee-5947-b573-ff03e90c6a06) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49342 |
vulnerable | 2026-07-29 00:57:45.383164 |
YARD static cache reads raw traversal paths before router sanitization
MEDIUM (5.3)
YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as `/../yard-cache-secret.html` is joined against that root and can return a readable sibling `.html` file outside the intended static tree. Version 0.9.44 patches the issue.
Published: 2026-06-19T19:13:59.598Z
Updated: 2026-06-22T17:14:14.512Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41493 |
vulnerable | 2026-06-08 08:03:15.486280 |
yard: Possible arbitrary path traversal and file access via yard server
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
Published: 2026-05-08T13:13:49.232Z
Updated: 2026-05-08T21:27:41.408Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27285 |
vulnerable | 2026-06-08 06:31:28.418109 |
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
MEDIUM (5.4)
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
Published: 2024-02-28T19:22:15.026Z
Updated: 2025-02-13T17:46:21.796Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.