Kramdown Project Kramdown vulnerabilities
2 known vulnerabilities affecting kramdown_project/kramdown.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2
Vulnerabilities
Page 1 of 1
CVE-2021-28834CRITICALCVSS 9.8fixed in 2.3.12021-03-19
CVE-2021-28834 [CRITICAL] CVE-2021-28834: Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thu
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
ghsanvdosv
CVE-2020-14001CRITICALCVSS 9.8fixed in 2.3.02020-07-17
CVE-2020-14001 [CRITICAL] CWE-862 CVE-2020-14001: The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by de
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Th
ghsanvdosv