CVE-2024-27285

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-272866.5Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, CVE-2024-272878.7ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, CVE-2024-272883.11Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain CVE-2024-272898.1pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met CVE-2024-27296.1The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final CVE-2024-272906.1Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including CVE-2024-272916.1Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an CVE-2024-272927.5Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access CVE-2024-272947.8dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the CVE-2024-272958.2Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows CVE-2024-272965.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number CVE-2024-272975.9Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix