CVE-2026-49342

RubyGems/yard CVE-2026-49342: medium 5.3

YARD static cache reads raw traversal paths before router sanitization

Action: Upgrade yard to 0.9.44 or later.

bundle update yard

Affected

Fixed versions

Sources

• osv: GHSA-pxcc-8665-phx8
• https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8
• https://nvd.nist.gov/vuln/detail/CVE-2026-49342
• https://github.com/lsegal/yard/commit/f78c19f0dd33a407085b4ed181bb60c0aa0078b4
• https://github.com/lsegal/yard

CVE-2026-49342 · published 2026-06-26T22:29:29Z · modified 2026-06-26T22:56:27.767407Z · JSON