NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
💎
💎 RubyGems
Not in CISA KEV
HIGH severity

Path Traversal vulnerability that affects yardGHSA-xfhh-rx56-rxcr

HIGH

GHSA-xfhh-rx56-rxcr is a high-severity (CVSS 7.5) Path Traversal vulnerability in yard. A fix is available for yard — see the affected versions and patch details below.

Also known asCVE-2019-1020001
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs84th percentile — riskier than 84% of all scored CVEsHighest risk
0.00%0.99%1.97%2.96%0.2%2.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
💎yard

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Possible arbitrary path traversal and file access via yard server

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
💎RubyGemsyardall versions0.9.20bundle update yard --conservative

Affected Products

1 product · 1 configurations
Application
yardyardoc
< 0.9.20
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for yard, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update yard to 0.9.20 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-xfhh-rx56-rxcr is resolved across your whole dependency graph.

  3. Workarounds

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

## Possible arbitrary path traversal and file access via `yard server` ### Impact A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability. ### Patches Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments. ### Workarounds For users who cannot u
O3 Security · Impact-Aware SCA

Is GHSA-xfhh-rx56-rxcr in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works
Path Traversal vulnerability that affects yard (High 7.5)