1 issue skipped by the security teams:
- CVE-2017-17042: lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/y/yard.png){kind=link}