CVE-2024-27285: Debian Linux

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 38 only
• Yardoc Yard: before 0.9.36 (fixed in 0.9.36)

Published 2024-02-28. Last modified 2026-06-17.