VulnerableCode Package Details - pkg:gem/yard@0.8.5

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:gem/yard@0.8.5

Essentials
History (8)

purl	pkg:gem/yard@0.8.5

Next non-vulnerable version	0.9.42
Latest non-vulnerable version	0.9.42
Risk	4.0

Vulnerabilities affecting this package (5)

Vulnerability	Summary	Fixed by
VCID-3bt7-mcww-3ug7 Aliases: CVE-2017-17042 GHSA-gj4p-3wh3-2rmf		0.9.11 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ed6k-yw87-s3cw Aliases: CVE-2024-27285 GHSA-8mq4-9jjh-9xrc		0.9.36 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-fqzr-pn4t-zyh6 Aliases: CVE-2019-1020001 GHSA-xfhh-rx56-rxcr		0.9.20 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-fwue-vswy-3fer Aliases: CVE-2026-41493 GHSA-3jfp-46x4-xgfj	YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.	0.9.42 Affected by 0 other vulnerabilities.
VCID-zwsc-1fvk-2bg6 Aliases: GMS-2013-20	This package is vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.	0.8.7.1 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-13T09:24:25.828364+00:00	Ruby Importer	Affected by	VCID-ed6k-yw87-s3cw	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml	38.6.0
2026-06-13T09:20:21.456178+00:00	Ruby Importer	Affected by	VCID-fqzr-pn4t-zyh6	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2019-1020001.yml	38.6.0
2026-06-13T09:20:08.400780+00:00	Ruby Importer	Affected by	VCID-3bt7-mcww-3ug7	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2017-17042.yml	38.6.0
2026-06-12T22:09:17.420780+00:00	GitLab Importer	Affected by	VCID-fwue-vswy-3fer	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/yard/CVE-2026-41493.yml	38.6.0
2026-06-12T19:21:47.351391+00:00	GitLab Importer	Affected by	VCID-ed6k-yw87-s3cw	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/yard/CVE-2024-27285.yml	38.6.0
2026-06-12T17:13:14.382068+00:00	GitLab Importer	Affected by	VCID-fqzr-pn4t-zyh6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/yard/CVE-2019-1020001.yml	38.6.0
2026-06-12T16:56:20.380042+00:00	GitLab Importer	Affected by	VCID-3bt7-mcww-3ug7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/yard/CVE-2017-17042.yml	38.6.0
2026-06-12T16:46:45.923134+00:00	GitLab Importer	Affected by	VCID-zwsc-1fvk-2bg6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/yard/GMS-2013-20.yml	38.6.0