High severity7.5GHSA Advisory· Published May 8, 2026· Updated May 12, 2026
CVE-2026-41493
CVE-2026-41493
Description
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
yardRubyGems | < 0.9.42 | 0.9.42 |
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-3jfp-46x4-xgfjghsaADVISORY
- github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfjnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41493ghsaADVISORY
- github.com/lsegal/yard/releases/tag/v0.9.42nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.