yard

Version	Released
`0.9.45` patch	Jul 14, 2026
`0.9.44` patch	May 25, 2026
`0.9.43` patch 1 CVE	Apr 18, 2026
`0.9.42` patch 1 CVE	Apr 16, 2026
`0.9.41` patch 2 CVEs	Apr 14, 2026
`0.9.40` patch 2 CVEs	Apr 13, 2026
`0.9.39` patch 2 CVEs	Apr 08, 2026
`0.9.38` patch 2 CVEs	Dec 05, 2025
`0.9.37` patch 2 CVEs	Sep 04, 2024
`0.9.36` patch 2 CVEs	Feb 29, 2024
`0.9.35` patch 3 CVEs	Feb 28, 2024
`0.9.34` patch 3 CVEs	Apr 12, 2023
`0.9.33` patch 3 CVEs	Apr 12, 2023
`0.9.30` patch 3 CVEs	Apr 09, 2023
`0.9.31` patch 3 CVEs	Apr 09, 2023
`0.9.32` patch 3 CVEs	Apr 09, 2023
`0.9.29` patch 3 CVEs	Apr 08, 2023
`0.9.28` patch 3 CVEs	Jun 01, 2022
`0.9.27` patch 3 CVEs	Nov 29, 2021
`0.9.26` patch 3 CVEs	Dec 27, 2020
`0.9.25` patch 3 CVEs	May 03, 2020
`0.9.24` patch 3 CVEs	Jan 08, 2020
`0.9.23` patch 3 CVEs	Jan 05, 2020
`0.9.21` patch 3 CVEs	Dec 31, 2019
`0.9.22` patch 3 CVEs	Dec 31, 2019
`0.9.20` patch 3 CVEs	Jun 27, 2019
`0.9.19` patch 4 CVEs	Apr 02, 2019
`0.9.17` patch 4 CVEs	Jan 21, 2019
`0.9.18` patch 4 CVEs	Jan 21, 2019
`0.9.16` patch 4 CVEs	Aug 11, 2018
`0.9.15` patch 4 CVEs	Jul 17, 2018
`0.9.14` patch 4 CVEs	Jun 02, 2018
`0.9.13` patch 4 CVEs	May 28, 2018
`0.9.12` patch 4 CVEs	Nov 26, 2017
`0.9.11` patch 4 CVEs	Nov 23, 2017
`0.9.10` patch 5 CVEs	Nov 18, 2017
`0.9.9` patch 5 CVEs	Apr 23, 2017
`0.9.8` patch 5 CVEs	Jan 13, 2017
`0.9.7` patch 5 CVEs	Jan 09, 2017
`0.9.6` patch 5 CVEs	Jan 07, 2017
`0.9.5` patch 5 CVEs	Jul 22, 2016
`0.9.4` patch 5 CVEs	Jul 21, 2016
`0.9.3` patch 5 CVEs	Jul 20, 2016
`0.9.2` patch 5 CVEs	Jul 19, 2016
`0.9.1` patch 5 CVEs	Jul 18, 2016
`0.9.0` minor 5 CVEs	Jul 04, 2016
`0.8.7.6` patch 5 CVEs	Oct 26, 2014
`0.8.7.5` patch 5 CVEs	Oct 26, 2014
`0.8.7.4` patch 5 CVEs	Mar 22, 2014
`0.8.7.3` patch 5 CVEs	Nov 01, 2013

0.9.45 patch

Jul 14, 2026

0.9.44 patch

May 25, 2026

0.9.43 patch

1 CVE

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

Apr 18, 2026

0.9.42 patch

1 CVE

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

Apr 16, 2026

0.9.41 patch

2 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

Apr 14, 2026

0.9.40 patch

2 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

Apr 13, 2026

0.9.39 patch

2 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

Apr 08, 2026

0.9.38 patch

2 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

Dec 05, 2025

0.9.37 patch

2 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

Sep 04, 2024

0.9.36 patch

2 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

Feb 29, 2024

0.9.35 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 28, 2024

0.9.34 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 12, 2023

0.9.33 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 12, 2023

0.9.30 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 09, 2023

0.9.31 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 09, 2023

0.9.32 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 09, 2023

0.9.29 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 08, 2023

0.9.28 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 01, 2022

0.9.27 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 29, 2021

0.9.26 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 27, 2020

0.9.25 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

May 03, 2020

0.9.24 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 08, 2020

0.9.23 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 05, 2020

0.9.21 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 31, 2019

0.9.22 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 31, 2019

0.9.20 patch

3 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 27, 2019

0.9.19 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 02, 2019

0.9.17 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 21, 2019

0.9.18 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 21, 2019

0.9.16 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 11, 2018

0.9.15 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 17, 2018

0.9.14 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 02, 2018

0.9.13 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

May 28, 2018

0.9.12 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 26, 2017

0.9.11 patch

4 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 23, 2017

0.9.10 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Nov 18, 2017

0.9.9 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Apr 23, 2017

0.9.8 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jan 13, 2017

0.9.7 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jan 09, 2017

0.9.6 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jan 07, 2017

0.9.5 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jul 22, 2016

0.9.4 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jul 21, 2016

0.9.3 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jul 20, 2016

0.9.2 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jul 19, 2016

0.9.1 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jul 18, 2016

0.9.0 minor

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Jul 04, 2016

0.8.7.6 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Oct 26, 2014

0.8.7.5 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Oct 26, 2014

0.8.7.4 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Mar 22, 2014

0.8.7.3 patch

5 CVEs

CVE-2026-49342 GHSA-pxcc-8665-phx8 Jun 26, 2026

YARD static cache reads raw traversal paths before router sanitization

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static tree.

The potential security risk seems low, as only html-ending files can be read, but still the risk of reading arbitrary html files is a confiendtiality issue in itself, which is why we decided to report. Please let us know if this is out of your project's scope.

Details

The --docroot CLI option stores the configured directory in server_options[:DocumentRoot] at lib/yard/cli/server.rb:198, and adapter initialization copies that value into adapter.document_root at lib/yard/server/adapter.rb:76. For Rack requests, RackAdapter#call builds a request object from the Rack environment at lib/yard/server/rack_adapter.rb:58 and passes it to router.call(request) at lib/yard/server/rack_adapter.rb:60. Router#call then stores the incoming request at lib/yard/server/router.rb:55 and invokes check_static_cache before normal routing at lib/yard/server/router.rb:56. Inside check_static_cache, the only initial guard is that adapter.document_root is present at lib/yard/server/static_caching.rb:35; the cache path is built from File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') at lib/yard/server/static_caching.rb:36, without cleaning .. components first. If that resolved path is a regular file, File.file? accepts it at lib/yard/server/static_caching.rb:38 and the file bytes are returned as a 200 HTML response at lib/yard/server/static_caching.rb:40. The later route sanitizer in final_options uses File.cleanpath(...).gsub(...) at lib/yard/server/router.rb:181 and lib/yard/server/router.rb:182, but a static-cache hit returns before that code is reached.

PoC

poc.zip

bash ./poc/run.sh

expected output:

run 1: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 2: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'
run 3: exit=0 timed_out=False duration=0.08s matched=True phase=oracle fingerprint='YARD_STATIC_CACHE_PATH_TRAVERSAL'

The YARD_STATIC_CACHE_PATH_TRAVERSAL fingerprint is emitted only after the PoC observes a 200 static-cache response whose body contains the sibling file outside the configured document root. A setup failure, syntax failure, or cache miss would not print this oracle and would not demonstrate this traversal read.

Impact

A remote unauthenticated HTTP client who can reach a YARD documentation server with DocumentRoot/--docroot enabled can request .html paths containing parent-directory components and receive readable matching files outside the configured document root. The required guards are narrow: adapter.document_root must be set, the traversed target must exist as a regular readable file, and the target must be reachable through the implementation's forced .html suffix. Those requests bypass the later final_options path cleanup because the cache check runs first. The resulting severity class is information disclosure: response bodies can contain off-root .html file contents, but this path does not show write access, code execution, or arbitrary files without the .html constraint.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 86 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.42


            0.9.43


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.44

References

Updated Jun 26, 2026 · Source: OSV.dev

CVE-2026-41493 GHSA-3jfp-46x4-xgfj Apr 17, 2026

yard: Possible arbitrary path traversal and file access via yard server

Medium

Network Low None None

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

The original patch in GHSA-xfhh-rx56-rxcr was incorrectly applied.

Patches

Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on --docroot.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 84 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.36


            0.9.37


            0.9.38


            0.9.39


            0.9.4


            0.9.40


            0.9.41


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.42

References

Updated Jun 09, 2026 · Source: OSV.dev

CVE-2024-27285 GHSA-8mq4-9jjh-9xrc Feb 28, 2024

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

Details

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34)

<script type="text/javascript">
  var match = unescape(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
  window.top.location = name;
</script>

(v0.9.35)

<script type="text/javascript">
  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
  var name = match ? match[1] : '<%= url_for_main %>';
  name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
  window.top.location.replace(name)
</script>

PoC (Proof of Concept)

To exploit this vulnerability:

Gain access to the generated Yard Doc.
Locate and access the "frames.html" file.
Construct a URL containing the malicious payload in the hash segment, for instance: #!javascript:xss for v0.9.34, and #:javascript:xss for v0.9.35

Impact

This XSS vulnerability presents a substantial threat by enabling an attacker to execute arbitrary JavaScript code within the user's session context. Potential ramifications include session hijacking, theft of sensitive data, unauthorized access to user accounts, and defacement of websites. Any user visiting the compromised page is susceptible to exploitation. It is critical to promptly address this vulnerability to mitigate potential harm to users and preserve the application's integrity.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 78 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.20


            0.9.21


            0.9.22


            0.9.23


            0.9.24


            0.9.25


            0.9.26


            0.9.27


            0.9.28


            0.9.29


            0.9.3


            0.9.30


            0.9.31


            0.9.32


            0.9.33


            0.9.34


            0.9.35


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.36

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2019-1020001 GHSA-xfhh-rx56-rxcr Jul 02, 2019

Path Traversal vulnerability that affects yard

7.5 / 10

High

Network Low None None Unchanged High None None

Possible arbitrary path traversal and file access via `yard server`

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 62 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.11


            0.9.12


            0.9.13


            0.9.14


            0.9.15


            0.9.16


            0.9.17


            0.9.18


            0.9.19


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.20

References

Updated Sep 10, 2026 · Source: OSV.dev

CVE-2017-17042 GHSA-gj4p-3wh3-2rmf Dec 21, 2017

Arbitrary file read vulnerability in yard server

7.5 / 10

High

Network Low None None Unchanged High None None

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected versions


          0.2.0


          0.2.1


          0.2.2


          0.2.3


          0.2.3.2


          0.2.3.3


          0.2.3.4


          0.2.3.5


          0.4.0


          0.5.0


          0.5.1


          0.5.1p1

+ 53 more


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.6.0


            0.6.1


            0.6.2


            0.6.3


            0.6.4


            0.6.5


            0.6.6


            0.6.7


            0.6.8


            0.7.0


            0.7.1


            0.7.2


            0.7.3


            0.7.4


            0.7.5


            0.8.0


            0.8.1


            0.8.2


            0.8.2.1


            0.8.3


            0.8.4


            0.8.4.1


            0.8.5


            0.8.5.1


            0.8.5.2


            0.8.6


            0.8.6.1


            0.8.6.2


            0.8.7


            0.8.7.1


            0.8.7.2


            0.8.7.3


            0.8.7.4


            0.8.7.5


            0.8.7.6


            0.9.0


            0.9.1


            0.9.10


            0.9.2


            0.9.3


            0.9.4


            0.9.5


            0.9.6


            0.9.7


            0.9.8


            0.9.9

Fixed in


          0.9.11

References

Updated Feb 16, 2024 · Source: OSV.dev

Nov 01, 2013

Activity

Reach

Details