Description
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u4 | DLA-235-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | ruby193-ruby +5 | 1.9.3.327-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-activesupport | 1:3.2.8-4.el6 | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-bcrypt-ruby | 3.0.1-7.el6 | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-bigdecimal | 1.1.0-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-bson | 1.5.2-6.el6op | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-chunky_png | 1.2.6-3.el6op | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-ci_reporter | 1.7.2-4.el6op | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-compass | 0.12.2-4.el6op | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-fastthread | 1.0.7-7.el6op | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-haml | 3.1.7-3.el6op | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-http_connection | 1.4.1-7.el6 | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-io-console | 0.3-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-json | 1.5.4-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-minitest | 2.5.1-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-rack | 1:1.4.1-5.el6 | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-rack-test | 0.6.1-3.el6 | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-rake | 0.9.2.2-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-rdoc | 3.9.4-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | ruby193-rubygem-rspec | 2.11.0-2.el6 | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-treetop | 1.4.10-6.el6 | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygem-xml-simple | 1.0.12-10.el6op | RHSA-2013:0728 |
| Red Hat OpenShift 1 | ruby193-rubygems +1 | 1.8.23-28.el6 | RHSA-2013:0701 |
| Red Hat OpenShift 1 | rubygem-json +1 | 1.7.3-2.el6op | RHSA-2013:0701 |
| Red Hat OpenShift 1 | rubygem-rdoc +1 | 3.8-9.el6op | RHSA-2013:0701 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rdoc | >= 2.3.0, < 3.12.1 | 3.12.1 | GHSA-v2r9-c84j-v7xm |
Advisories 3
- RHSA-2013:0701 Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update Red Hat Security Advisories (RHSA) · Apr 28, 2026
- RHSA-2013:0728 Red Hat Security Advisory: rubygem packages security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- DLA-235-1 ruby1.9.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2013:0701 vendor-advisory
- http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/
- 52774 third-party-advisory
- openSUSE-SU-2013:0303 vendor-advisory
- http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2
- RHSA-2013:0728 vendor-advisory
- RHSA-2013:0686 vendor-advisory
- https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60
- RHSA-2013:0548 vendor-advisory
- USN-1733-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=907820
- SUSE-SU-2013:0647 vendor-advisory