Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-658d-9w1u-q7fh
|
Possible arbitrary path traversal and file access via yard server
### Impact
A path traversal vulnerability was discovered in YARD <= 0.9.41 when
using yard server to serve documentation. This bug would allow
unsanitized HTTP requests to access arbitrary files on the machine
of a yard server host under certain conditions.
The original patch in [GHSA-xfhh-rx56-rxcr](https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr)
was incorrectly applied.
### Patches
Please upgrade to YARD v0.9.42 immediately if you are relying on
yard server to host documentation in any untrusted environments
without WEBrick and rely on `--docroot`.
### Workarounds
For users who cannot upgrade, it is possible to perform path
sanitization of HTTP requests at your webserver level. WEBrick,
for example, can perform such sanitization by default (which
you can use via yard server -s webrick), as can certain rules
in your webserver configuration.
|
CVE-2026-41493
GHSA-3jfp-46x4-xgfj
|