CVE-2026-41493

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/lsegal/yard/releases/tag/v0.9.42	Product Release Notes
https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:yardoc:yard:*:*:*:*:*:*:*:*

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) YARD es una herramienta de documentación de Ruby. Antes de la versión 0.9.42, se descubrió una vulnerabilidad de salto de ruta en YARD al usar el servidor de yard para servir documentación. Este error permitiría que solicitudes HTTP no saneadas accedieran a archivos arbitrarios en la máquina de un host del servidor de yard bajo ciertas condiciones. Este problema ha sido parcheado en la versión 0.9.42.

Information

Published : 2026-05-08 14:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-41493

Mitre link : CVE-2026-41493

CVE.ORG link : CVE-2026-41493

JSON object : View

Products Affected

yardoc

yard

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-41493", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41493", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T14:15:08.883899Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lsegal", "product": "yard", "versions": [{"status": "affected", "version": "< 0.9.42"}]}]}], "published": "2026-05-08T14:16:33.550", "references": [{"url": "https://github.com/lsegal/yard/releases/tag/v0.9.42", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42."}, {"lang": "es", "value": "YARD es una herramienta de documentaci\u00f3n de Ruby. Antes de la versi\u00f3n 0.9.42, se descubri\u00f3 una vulnerabilidad de salto de ruta en YARD al usar el servidor de yard para servir documentaci\u00f3n. Este error permitir\u00eda que solicitudes HTTP no saneadas accedieran a archivos arbitrarios en la m\u00e1quina de un host del servidor de yard bajo ciertas condiciones. Este problema ha sido parcheado en la versi\u00f3n 0.9.42."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yardoc:yard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C78A11A0-6F27-4A70-9A20-C0E2B4264309", "versionEndExcluding": "0.9.42"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}