{"id":"CVE-2013-0256","aliases":["DLA-235-1","EUVD-2017-0308","GHSA-v2r9-c84j-v7xm","RHSA-2013:0701","RHSA-2013:0728"],"status":"published","title":"RDoc contains XSS vulnerability","description":"darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02992,"percentile":0.87427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2013-03-01T02:00:00Z","modified":"2026-06-16T23:49:04Z","fixes":[{"ecosystem":"RubyGems","package":"rdoc","fixed_in":["3.12.1"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-activesupport","fixed_in":["1:3.2.8-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-bcrypt-ruby","fixed_in":["0:3.0.1-7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-bcrypt-ruby-debuginfo","fixed_in":["0:3.0.1-7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-bson","fixed_in":["0:1.5.2-6.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-chunky_png","fixed_in":["0:1.2.6-3.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-ci_reporter","fixed_in":["0:1.7.2-4.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-compass","fixed_in":["0:0.12.2-4.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-fastthread","fixed_in":["0:1.0.7-7.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-fastthread-debuginfo","fixed_in":["0:1.0.7-7.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-haml","fixed_in":["0:3.1.7-3.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-http_connection","fixed_in":["0:1.4.1-7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rack","fixed_in":["1:1.4.1-5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rack-test","fixed_in":["0:0.6.1-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rspec","fixed_in":["0:2.11.0-2.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-treetop","fixed_in":["0:1.4.10-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-xml-simple","fixed_in":["0:1.0.12-10.el6op"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"3.12.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ruby1.9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.0-2+deb6u4"}]}],"versions":["1.9.2.0-2","1.9.2.0-2+armhf"],"bundled":6},{"source":"osv","ecosystem":"RubyGems","package":"rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"3.12.1"}]}],"versions":["2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.5","2.5.1","2.5.10","2.5.11","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","3.0","3.0.1","3.1","3.10","3.10.pre.1","3.10.pre.2","3.10.pre.3","3.11","3.12","3.2","3.3","3.4","3.5","3.5.1","3.5.2","3.5.3","3.6","3.6.1","3.7","3.8","3.9","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3.327-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3.327-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3.327-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3.327-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3.327-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3.327-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.3.327-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2.2-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-28.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-2.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-2.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-json-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-2.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8-9.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-rdoc-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8-9.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-bcrypt-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-bcrypt-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-6.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-chunky_png","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-3.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-ci_reporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-4.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-compass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.2-4.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-fastthread","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-7.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-fastthread-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-7.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-haml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.7-3.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-http_connection","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.1-5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rack-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rspec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-2.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-treetop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.10-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-xml-simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.12-10.el6op"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"ruby-lang","product":"rdoc"},{"vendor":"ruby-lang","product":"ruby"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0701.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","article"]},{"url":"http://secunia.com/advisories/52774","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0728.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0686.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0548.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1733-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=907820","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0256","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v2r9-c84j-v7xm","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2013-0256.yml","tags":["web"]},{"url":"https://web.archive.org/web/20130402173730/http://blog.segment7.net:80/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2","tags":["web"]},{"url":"https://github.com/rdoc/rdoc","tags":["package"]},{"url":"http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0701","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909029","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0701.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0256","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0256","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0269","tags":["advisory"]},{"url":"http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0728","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0728.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-0256","description":"darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.","status":"published","published":"2013-03-01T02:00:00Z","modified":"2024-08-06T14:18:09.523Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2017-0308","description":"darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.","status":"published","published":"2013-03-01T02:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-v2r9-c84j-v7xm","title":"RDoc contains XSS vulnerability","description":"darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-07-05T20:39:59Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2013-0256","description":"darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.","status":"published","published":"2013-03-01T05:40:17.583Z","modified":"2026-06-16T23:49:04.09Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"RHSA-2013:0701","title":"Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update","status":"published","published":"2024-09-15T20:40:20Z","modified":"2026-04-28T10:01:40Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0728","title":"Red Hat Security Advisory: rubygem packages security update","status":"published","published":"2024-09-15T20:33:59Z","modified":"2026-03-23T04:45:36.155337Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"DLA-235-1","title":"ruby1.9.1 - security update","status":"published","published":"2015-05-30T00:00:00Z","modified":"2026-03-09T01:20:33.535243Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"GHSA-v2r9-c84j-v7xm","title":"RDoc contains XSS vulnerability","description":"darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-08T05:30:44.530977Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.639206Z"}]}}