Skip to content
OpenAdvisories
High DLA-3753-1 2 CVEs

yard - security update

Published Mar 6, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 yard 0.9.16-1+deb10u1

Vulnerabilities 2

  • High 7.5
    CVE-2019-1020001

    Path Traversal vulnerability that affects yard

    yard before 0.9.20 allows path traversal.

    yard yard yard yard Debian Ubuntu RubyGems
  • Medium 5.4
    CVE-2024-27285

    YARD's default template vulnerable to Cross-site Scripting in generated frames.html

    YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template…

    lsegal yard yard yard Debian Ubuntu RubyGems