CVE-2013-0256: XSS exploit of RDoc documentation generated by rdoc

March 1, 2013 (updated June 4, 2013)

This exploit may lead to cookie disclosure to third parties. The exploit exists in darkfish.js which is copied from the RDoc install location to the generated documentation. RDoc is a static documentation generation tool. Patching the library itself is insufficient to correct this exploit.

References

github.com/rdoc/rdoc/blob/master/CVE-2013-0256.rdoc

Code Behaviors & Features

Detect and mitigate CVE-2013-0256 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →