Description
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lsegal | yard | < 0.9.36 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | yard | 0.9.36-1 | — |
| Debian 13 | yard | 0.9.36-1 | — |
| Debian 12 | yard | 0.9.28-2+deb12u2 | DSA-5635-1 |
| Debian 11 | yard | 0.9.24-1+deb11u1 | DSA-5635-1 |
| Debian 10 | yard | 0.9.16-1+deb10u1 | DLA-3753-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | yard | 0.9.26-1ubuntu0.1 | USN-6731-1 |
| Ubuntu 20.04 LTS | yard | 0.9.24-1+deb11u1build0.20.04.1 | USN-6731-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | yard | 0.9.12-2ubuntu0.1~esm1 | USN-6731-1 |
| Ubuntu Pro 16.04 LTS | yard | 0.8.7.6+git20160220-3ubuntu0.1~esm1 | USN-6731-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | yard | < 0.9.36 | 0.9.36 | GHSA-8mq4-9jjh-9xrc |
Advisories 3
- USN-6731-1 yard vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5635-1 yard - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3753-1 yard - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
- https://github.com/lsegal/yard/pull/1538
- https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
- https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
- https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/