VulnerableCode Package Details - pkg:gem/rdoc@6.4.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-swkc-upxh-jqgn Aliases: CVE-2024-27281 GHSA-592j-995h-p23j	RDoc RCE vulnerability with .rdoc_options An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache. We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: * For Ruby 3.0 users: Update to `rdoc` 6.3.4.1 * For Ruby 3.1 users: Update to `rdoc` 6.4.1.1 * For Ruby 3.2 users: Update to `rdoc` 6.5.1.1 You can use `gem update rdoc` to update it. If you are using bundler, please add `gem "rdoc", ">= 6.6.3.1"` to your `Gemfile`. Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.	6.4.1.1 Affected by 0 other vulnerabilities. 6.5.1.1 Affected by 0 other vulnerabilities. 6.6.3.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-swkc-upxh-jqgn
Aliases:
CVE-2024-27281
GHSA-592j-995h-p23j

RDoc RCE vulnerability with .rdoc_options An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache. We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: * For Ruby 3.0 users: Update to `rdoc` 6.3.4.1 * For Ruby 3.1 users: Update to `rdoc` 6.4.1.1 * For Ruby 3.2 users: Update to `rdoc` 6.5.1.1 You can use `gem update rdoc` to update it. If you are using bundler, please add `gem "rdoc", ">= 6.6.3.1"` to your `Gemfile`. Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.

6.4.1.1
Affected by 0 other vulnerabilities.

6.5.1.1
Affected by 0 other vulnerabilities.

6.6.3.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-03T19:01:45.359744+00:00	GitLab Importer	Affected by	VCID-swkc-upxh-jqgn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rdoc/CVE-2024-27281.yml	37.0.0
2025-07-01T18:15:42.024597+00:00	GitLab Importer	Affected by	VCID-swkc-upxh-jqgn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rdoc/CVE-2024-27281.yml	36.1.3
2025-07-01T14:34:34.345173+00:00	GHSA Importer	Affected by	VCID-swkc-upxh-jqgn	https://github.com/advisories/GHSA-592j-995h-p23j	36.1.3