CVE-2024-27285

Summary

CVE-2024-27285 is a Cross-Site Scripting (XSS) vulnerability affecting the YARD Ruby documentation tool. The vulnerability lies in the "frames.html" file, which is part of the generated documentation. The issue stems from insufficient sanitization of user input within the JavaScript segment of the "frames.erb" template file. Attackers can exploit this flaw to inject malicious scripts, potentially stealing sensitive information or gaining unauthorized access to user accounts. The vulnerability has been addressed in version 0.9.36.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.