Description
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lsegal yard
< 0.9.36affected
References
- https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc ↗
- https://github.com/lsegal/yard/pull/1538 ↗
- https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa ↗
- https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be ↗
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml ↗
- https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/ ↗