Most recent entries from all

EUVD-2026-217342

fkie_cve-2024-27285

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

GHSA-8mq4-9jjh-9xrc — YARD's default template vulnerable to Cross-site Scripting in generated frames.html

Affected: RubyGems: yard

### Summary The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.

### Details The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.

Snippet from "frames.erb": (v0.9.34) ```erb <script type="text/javascript"> var match = unescape(window.location.hash).match(/^#!(.+)/); var name = match ? match[1] : '<%= url_for_main %>'; name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, ''); window.top.location = name; </script> ```

(v0.9.35) ```erb <script type="text/javascript"> var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/); var name = match ? match[1] : '<%= url_for_main %>'; name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim(); window.top.location.replace(name) </script> ```

### PoC (Proof of Concept) To exploit this vulnerability: 1. Gain access to the generated Yard Doc. 2. Locate and access the "frames.html" file. 3. Construct a URL containing the malicious payload in the hash segment, for instance: `#!javascript:xss` fo…

gsd-2024-27285

OESA-2024-1256 — rubygem-yard security update

Affected: openEuler:20.03-LTS-SP1: rubygem-yard, openEuler:20.03-LTS-SP4: rubygem-yard, openEuler:22.03-LTS: rubygem-yard, openEuler:22.03-LTS-SP1: rubygem-yard, openEuler:22.03-LTS-SP2: rubygem-yard, openEuler:22.03-LTS-SP3: rubygem-yard

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions. Security Fix(es): YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.(CVE-2024-27285)

UBUNTU-CVE-2024-27285

Affected: Ubuntu:Pro:16.04:LTS: yard, Ubuntu:Pro:18.04:LTS: yard, Ubuntu:20.04:LTS: yard, Ubuntu:22.04:LTS: yard