Nixpkgs security tracker
Permalink
CVE-2026-41493
6.9 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @mweinelt Activity log
- Created suggestion
-
@mweinelt
ignored
14 packages
- python312Packages.pyyardian
- python313Packages.pyyardian
- python313Packages.yardstick
- python314Packages.pyyardian
- python314Packages.yardstick
- rubyPackages.yard-solargraph
- home-assistant-component-tests.yardian
- rubyPackages.yard-activesupport-concern
- rubyPackages_3_3.yard-activesupport-concern
- rubyPackages_3_4.yard-activesupport-concern
- rubyPackages_4_0.yard-activesupport-concern
- rubyPackages_3_3.yard-solargraph
- rubyPackages_3_4.yard-solargraph
- rubyPackages_4_0.yard-solargraph
- @mweinelt accepted
- @mweinelt published on GitHub
yard: Possible arbitrary path traversal and file access via yard server
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
References
-
https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj x_refsource_CONFIRM
-
https://github.com/lsegal/yard/releases/tag/v0.9.42 x_refsource_MISC
Affected products
yard
- ==< 0.9.42
Matching in nixpkgs
Ignored packages (14)
pkgs.python312Packages.pyyardian
Module for interacting with the Yardian irrigation controller
pkgs.python313Packages.pyyardian
Module for interacting with the Yardian irrigation controller
pkgs.python313Packages.yardstick
Module to compare vulnerability scanners results
pkgs.python314Packages.pyyardian
Module for interacting with the Yardian irrigation controller
pkgs.python314Packages.yardstick
Module to compare vulnerability scanners results
pkgs.rubyPackages.yard-solargraph
None
pkgs.rubyPackages_3_3.yard-solargraph
None
pkgs.rubyPackages_3_4.yard-solargraph
None
pkgs.rubyPackages_4_0.yard-solargraph
None
pkgs.home-assistant-component-tests.yardian
Open source home automation that puts local control and privacy first
pkgs.rubyPackages.yard-activesupport-concern
None