CVE-2024-27285

MEDIUM

YARD <0.9.35 - XSS

Title source: llm
STIX 2.1

Description

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

References (7)

Core 7
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
Issue Tracking, Patch x_refsource_misc
https://github.com/lsegal/yard/pull/1538

Scores

CVSS v3 5.4
EPSS 0.0332
EPSS Percentile 87.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (4)
debian/debian_linux 10.0
fedoraproject/fedora 38
rubygems/yard 0 - 0.9.36RubyGems
yardoc/yard < 0.9.36
Published Feb 28, 2024
Tracked Since Feb 18, 2026