https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:09:03.427120+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-217342 EUVD-2026-217342 2026-10-03T17:09:03.431056+00:00 EUVD-2026-217342 https://cve.radiocsirt.org/vuln/fkie_cve-2024-27285 fkie_cve-2024-27285 2026-10-03T17:09:03.431086+00:00

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

 https://cve.radiocsirt.org/vuln/ghsa-8mq4-9jjh-9xrc GHSA-8mq4-9jjh-9xrc — YARD's default template vulnerable to Cross-site Scripting in generated frames.html 2026-10-03T17:09:03.431119+00:00

Affected: RubyGems: yard

### Summary The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

### Details The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34) ```erb <script type="text/javascript"> var match = unescape(window.location.hash).match(/^#!(.+)/); var name = match ? match[1] : '<%= url_for_main %>'; name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, ''); window.top.location = name; </script> ```

(v0.9.35) ```erb <script type="text/javascript"> var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/); var name = match ? match[1] : '<%= url_for_main %>'; name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim(); window.top.location.replace(name) </script> ```

### PoC (Proof of Concept) To exploit this vulnerability: 1. Gain access to the generated Yard Doc. 2. Locate and access the "frames.html" file. 3. Construct a URL containing the malicious payload in the hash segment, for instance: `#!javascript:xss` fo…

 https://cve.radiocsirt.org/vuln/gsd-2024-27285 gsd-2024-27285 2026-10-03T17:09:03.431166+00:00 gsd-2024-27285 https://cve.radiocsirt.org/vuln/oesa-2024-1256 OESA-2024-1256 — rubygem-yard security update 2026-10-03T17:09:03.431181+00:00

Affected: openEuler:20.03-LTS-SP1: rubygem-yard, openEuler:20.03-LTS-SP4: rubygem-yard, openEuler:22.03-LTS: rubygem-yard, openEuler:22.03-LTS-SP1: rubygem-yard, openEuler:22.03-LTS-SP2: rubygem-yard, openEuler:22.03-LTS-SP3: rubygem-yard

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions. Security Fix(es): YARD is a Ruby Documentation tool. The &quot;frames.html&quot; file within the Yard Doc&apos;s generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the &quot;frames.erb&quot; template file. This vulnerability is fixed in 0.9.36.(CVE-2024-27285)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-27285 UBUNTU-CVE-2024-27285 2026-10-03T17:09:03.431224+00:00

Affected: Ubuntu:Pro:16.04:LTS: yard, Ubuntu:Pro:18.04:LTS: yard, Ubuntu:20.04:LTS: yard, Ubuntu:22.04:LTS: yard

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.