CVE-2013-0256

RDoc contains XSS vulnerability

4.3 MediumFix available

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

Exploit likelihood

2.99%Up 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2013-0256
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-0256
Updated: 2026-11-02

EUVDEUVD-2017-0308 No score

Record: EUVD-2017-0308
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v2r9-c84j-v7xm No score

RDoc contains XSS vulnerability

Record: GHSA-v2r9-c84j-v7xm
Weakness: CWE-79
Updated: 2026-11-02

OSVRHSA-2013:0701 5.4

Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update

Record: RHSA-2013:0701
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVRHSA-2013:0728 5.4

Red Hat Security Advisory: rubygem packages security update

Record: RHSA-2013:0728
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-v2r9-c84j-v7xm No score

RDoc contains XSS vulnerability

Record: GHSA-v2r9-c84j-v7xm
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`rdoc` RubyGems	2.3.0 up to 3.12.1	3.12.1
`ruby1.9.1` Debian:6.0	before 1.9.2.0-2+deb6u4, plus listed versions 1.9.2.0-21.9.2.0-2+armhf	1.9.2.0-2+deb6u4
`rdoc` RubyGems	2.3.0 up to 3.12.1, plus listed versions 2.4.02.4.12.4.22.4.32.5 Show 37 moreShow less 2.5.12.5.102.5.112.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.93.03.0.13.13.103.10.pre.13.10.pre.23.10.pre.33.113.123.23.33.43.53.5.13.5.23.5.33.63.6.13.73.83.93.9.13.9.23.9.33.9.43.9.5	3.12.1
`ruby193-ruby` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-debuginfo` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-devel` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-doc` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-irb` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-libs` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6
`ruby193-ruby-tcltk` Red Hat:openshift:1::el6	before 0:1.9.3.327-28.el6	0:1.9.3.327-28.el6

Show 29 moreShow less

Affected packages
Package	Affected	Fixed
`ruby193-rubygem-bigdecimal` Red Hat:openshift:1::el6	before 0:1.1.0-28.el6	0:1.1.0-28.el6
`ruby193-rubygem-io-console` Red Hat:openshift:1::el6	before 0:0.3-28.el6	0:0.3-28.el6
`ruby193-rubygem-json` Red Hat:openshift:1::el6	before 0:1.5.4-28.el6	0:1.5.4-28.el6
`ruby193-rubygem-minitest` Red Hat:openshift:1::el6	before 0:2.5.1-28.el6	0:2.5.1-28.el6
`ruby193-rubygem-rake` Red Hat:openshift:1::el6	before 0:0.9.2.2-28.el6	0:0.9.2.2-28.el6
`ruby193-rubygem-rdoc` Red Hat:openshift:1::el6	before 0:3.9.4-28.el6	0:3.9.4-28.el6
`ruby193-rubygems` Red Hat:openshift:1::el6	before 0:1.8.23-28.el6	0:1.8.23-28.el6
`ruby193-rubygems-devel` Red Hat:openshift:1::el6	before 0:1.8.23-28.el6	0:1.8.23-28.el6
`rubygem-json` Red Hat:openshift:1::el6	before 0:1.7.3-2.el6op	0:1.7.3-2.el6op
`rubygem-json-debuginfo` Red Hat:openshift:1::el6	before 0:1.7.3-2.el6op	0:1.7.3-2.el6op
`rubygem-json-doc` Red Hat:openshift:1::el6	before 0:1.7.3-2.el6op	0:1.7.3-2.el6op
`rubygem-rdoc` Red Hat:openshift:1::el6	before 0:3.8-9.el6op	0:3.8-9.el6op
`rubygem-rdoc-doc` Red Hat:openshift:1::el6	before 0:3.8-9.el6op	0:3.8-9.el6op
`ruby193-rubygem-activesupport` Red Hat:openshift:1::el6	before 1:3.2.8-4.el6	1:3.2.8-4.el6
`ruby193-rubygem-bcrypt-ruby` Red Hat:openshift:1::el6	before 0:3.0.1-7.el6	0:3.0.1-7.el6
`ruby193-rubygem-bcrypt-ruby-debuginfo` Red Hat:openshift:1::el6	before 0:3.0.1-7.el6	0:3.0.1-7.el6
`ruby193-rubygem-bson` Red Hat:openshift:1::el6	before 0:1.5.2-6.el6op	0:1.5.2-6.el6op
`ruby193-rubygem-chunky_png` Red Hat:openshift:1::el6	before 0:1.2.6-3.el6op	0:1.2.6-3.el6op
`ruby193-rubygem-ci_reporter` Red Hat:openshift:1::el6	before 0:1.7.2-4.el6op	0:1.7.2-4.el6op
`ruby193-rubygem-compass` Red Hat:openshift:1::el6	before 0:0.12.2-4.el6op	0:0.12.2-4.el6op
`ruby193-rubygem-fastthread` Red Hat:openshift:1::el6	before 0:1.0.7-7.el6op	0:1.0.7-7.el6op
`ruby193-rubygem-fastthread-debuginfo` Red Hat:openshift:1::el6	before 0:1.0.7-7.el6op	0:1.0.7-7.el6op
`ruby193-rubygem-haml` Red Hat:openshift:1::el6	before 0:3.1.7-3.el6op	0:3.1.7-3.el6op
`ruby193-rubygem-http_connection` Red Hat:openshift:1::el6	before 0:1.4.1-7.el6	0:1.4.1-7.el6
`ruby193-rubygem-rack` Red Hat:openshift:1::el6	before 1:1.4.1-5.el6	1:1.4.1-5.el6
`ruby193-rubygem-rack-test` Red Hat:openshift:1::el6	before 0:0.6.1-3.el6	0:0.6.1-3.el6
`ruby193-rubygem-rspec` Red Hat:openshift:1::el6	before 0:2.11.0-2.el6	0:2.11.0-2.el6
`ruby193-rubygem-treetop` Red Hat:openshift:1::el6	before 0:1.4.10-6.el6	0:1.4.10-6.el6
`ruby193-rubygem-xml-simple` Red Hat:openshift:1::el6	before 0:1.0.12-10.el6op	0:1.0.12-10.el6op

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-0256 is a medium vulnerability (CVSS 4.3) in Ruby-lang Rdoc, published March 1, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in rdoc 3.12.1.

References

Show 23 moreShow less