CVE-2013-0256

RDoc contains XSS vulnerability

4.3 MediumFix available

CVE-2013-0256 is a medium vulnerability (CVSS 4.3) in Ruby-lang Rdoc, published March 1, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in rdoc 3.12.1.

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

Exploit likelihood

2.99%Up 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2013-0256
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-0256
Updated: 2026-11-02

EUVDEUVD-2017-0308 No score

Record: EUVD-2017-0308
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v2r9-c84j-v7xm No score

RDoc contains XSS vulnerability

Record: GHSA-v2r9-c84j-v7xm
Weakness: CWE-79
Updated: 2026-11-02

OSVRHSA-2013:0701 5.4

Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update

Record: RHSA-2013:0701
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVRHSA-2013:0728 5.4

Red Hat Security Advisory: rubygem packages security update

Record: RHSA-2013:0728
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-v2r9-c84j-v7xm No score

RDoc contains XSS vulnerability

Record: GHSA-v2r9-c84j-v7xm
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`rdoc` RubyGems	2.3.0 up to 3.12.1	3.12.1
`ruby1.9.1` Debian:6.0	before 1.9.2.0-2+deb6u4, plus listed versions 1.9.2.0-21.9.2.0-2+armhf	1.9.2.0-2+deb6u4
`rdoc` RubyGems	2.3.0 up to 3.12.1, plus listed versions 2.4.02.4.12.4.22.4.32.5 Show 37 moreShow less 2.5.12.5.102.5.112.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.93.03.0.13.13.103.10.pre.13.10.pre.23.10.pre.33.113.123.23.33.43.53.5.13.5.23.5.33.63.6.13.73.83.93.9.13.9.23.9.33.9.43.9.5	3.12.1
`ruby193-ruby` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-debuginfo` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-devel` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-doc` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-irb` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-libs` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-tcltk` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6

Show 29 moreShow less

Affected packages
Package	Affected	Fixed
`ruby193-rubygem-bigdecimal` Red Hat:openshift:1::el6	before 0:1.1.0-28.el6	0:1.1.0-28.el6
`ruby193-rubygem-io-console` Red Hat:openshift:1::el6	before 0:0.3-28.el6	0:0.3-28.el6
`ruby193-rubygem-json` Red Hat:openshift:1::el6	before 0:1.5.4-28.el6	0:1.5.4-28.el6
`ruby193-rubygem-minitest` Red Hat:openshift:1::el6	before 0:2.5.1-28.el6	0:2.5.1-28.el6
`ruby193-rubygem-rake` Red Hat:openshift:1::el6	before 0:0.9.2.2-28.el6	0:0.9.2.2-28.el6
`ruby193-rubygem-rdoc` Red Hat:openshift:1::el6	before 0:3.9.4-28.el6	0:3.9.4-28.el6
`ruby193-rubygems` Red Hat:openshift:1::el6	before 0:1.8.23-28.el6	0:1.8.23-28.el6
`ruby193-rubygems-devel` Red Hat:openshift:1::el6	before 0:1.8.23-28.el6	0:1.8.23-28.el6
`rubygem-json` Red Hat:openshift:1::el6	before 0:1.7.3-2.el6op	0:1.7.3-2.el6op
`rubygem-json-debuginfo` Red Hat:openshift:1::el6	before 0:1.7.3-2.el6op	0:1.7.3-2.el6op
`rubygem-json-doc` Red Hat:openshift:1::el6	before 0:1.7.3-2.el6op	0:1.7.3-2.el6op
`rubygem-rdoc` Red Hat:openshift:1::el6	before 0:3.8-9.el6op	0:3.8-9.el6op
`rubygem-rdoc-doc` Red Hat:openshift:1::el6	before 0:3.8-9.el6op	0:3.8-9.el6op
`ruby193-rubygem-activesupport` Red Hat:openshift:1::el6	before 1:3.2.8-4.el6	1:3.2.8-4.el6
`ruby193-rubygem-bcrypt-ruby` Red Hat:openshift:1::el6	before 0:3.0.1-7.el6	0:3.0.1-7.el6
`ruby193-rubygem-bcrypt-ruby-debuginfo` Red Hat:openshift:1::el6	before 0:3.0.1-7.el6	0:3.0.1-7.el6
`ruby193-rubygem-bson` Red Hat:openshift:1::el6	before 0:1.5.2-6.el6op	0:1.5.2-6.el6op
`ruby193-rubygem-chunky_png` Red Hat:openshift:1::el6	before 0:1.2.6-3.el6op	0:1.2.6-3.el6op
`ruby193-rubygem-ci_reporter` Red Hat:openshift:1::el6	before 0:1.7.2-4.el6op	0:1.7.2-4.el6op
`ruby193-rubygem-compass` Red Hat:openshift:1::el6	before 0:0.12.2-4.el6op	0:0.12.2-4.el6op
`ruby193-rubygem-fastthread` Red Hat:openshift:1::el6	before 0:1.0.7-7.el6op	0:1.0.7-7.el6op
`ruby193-rubygem-fastthread-debuginfo` Red Hat:openshift:1::el6	before 0:1.0.7-7.el6op	0:1.0.7-7.el6op
`ruby193-rubygem-haml` Red Hat:openshift:1::el6	before 0:3.1.7-3.el6op	0:3.1.7-3.el6op
`ruby193-rubygem-http_connection` Red Hat:openshift:1::el6	before 0:1.4.1-7.el6	0:1.4.1-7.el6
`ruby193-rubygem-rack` Red Hat:openshift:1::el6	before 1:1.4.1-5.el6	1:1.4.1-5.el6
`ruby193-rubygem-rack-test` Red Hat:openshift:1::el6	before 0:0.6.1-3.el6	0:0.6.1-3.el6
`ruby193-rubygem-rspec` Red Hat:openshift:1::el6	before 0:2.11.0-2.el6	0:2.11.0-2.el6
`ruby193-rubygem-treetop` Red Hat:openshift:1::el6	before 0:1.4.10-6.el6	0:1.4.10-6.el6
`ruby193-rubygem-xml-simple` Red Hat:openshift:1::el6	before 0:1.0.12-10.el6op	0:1.0.12-10.el6op

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 23 moreShow less