CVE-2013-0256

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

• CWE-79

• http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0548.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0686.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0701.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0728.htmlThird Party Advisory
• http://secunia.com/advisories/52774Third Party Advisory
• http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/Vendor Advisory
• http://www.ubuntu.com/usn/USN-1733-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=907820Issue Tracking
• https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60Third Party Advisory
• http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0548.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0686.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0701.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0728.htmlThird Party Advisory
• http://secunia.com/advisories/52774Third Party Advisory
• http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/Vendor Advisory
• http://www.ubuntu.com/usn/USN-1733-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=907820Issue Tracking
• https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60Third Party Advisory

Published

Mar 1, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0250The init_nss_hash function in exec/totemcrypto.c in Corosync…
• CVE-2013-0251Stack-based buffer overflow in llogincircuit.cc in latd 1.25…
• CVE-2013-0252boost::locale::utf::utf_traits in the Boost.Locale library i…
• CVE-2013-0253The default configuration of Apache Maven 3.0.4, when using …
• CVE-2013-0254The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7…
• CVE-2013-0255PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x bef…
• CVE-2013-0257The email2image module 6.x-1.x and 6.x-2.x for Drupal does n…
• CVE-2013-0258The Google Authenticator login (ga_login) module 7.x before …
• CVE-2013-0259Cross-site scripting (XSS) vulnerability in the Boxes module…
• CVE-2013-0260Unspecified vulnerability in the Drush Debian Packaging modu…
• CVE-2013-0261A flaw was found in PackStack. A local user could exploit a …8.8
• CVE-2013-0262rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4…