CVE-2026-41493

RubyGems/yard CVE-2026-41493: medium, EPSS 0.52%

yard: Possible arbitrary path traversal and file access via yard server

Action: Upgrade yard to 0.9.42 or later.

bundle update yard

Affected

Fixed versions

Sources

• osv: GHSA-3jfp-46x4-xgfj
• https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj
• https://nvd.nist.gov/vuln/detail/CVE-2026-41493
• https://github.com/lsegal/yard
• https://github.com/lsegal/yard/releases/tag/v0.9.42
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2026-41493.yml

CVE-2026-41493 · published 2026-04-17T22:21:03Z · modified 2026-06-09T10:55:28Z · JSON