{"action":"Upgrade yard to 0.9.36 or later.","affected":[{"fixed":"0.9.36","introduced":"0"}],"component":"yard","cve_ids":["CVE-2024-27285"],"ecosystem":"RubyGems","epss":0.0106,"exploited":false,"fixed_versions":["0.9.36"],"ghsa_id":"GHSA-8mq4-9jjh-9xrc","id":"tcs_01M5KEJ33K0QWZWAJX0BQCHF6N","modified_at":"2026-09-10T03:50:05.473957301Z","published_at":"2024-02-28T18:57:19Z","references":["https://osv.dev/vulnerability/GHSA-8mq4-9jjh-9xrc","https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc","https://nvd.nist.gov/vuln/detail/CVE-2024-27285","https://github.com/lsegal/yard/pull/1538","https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa","https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be","https://github.com/advisories/GHSA-8mq4-9jjh-9xrc","https://github.com/lsegal/yard","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml","https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-8mq4-9jjh-9xrc","url":"https://osv.dev/vulnerability/GHSA-8mq4-9jjh-9xrc"}],"summary":"YARD's default template vulnerable to Cross-site Scripting in generated frames.html"}