debian/ruby-kramdown vulnerabilities

Latest debian/ruby-kramdown CVEs

Newest publication first

1. DSA-4890-1 ruby-kramdown - security update

   Published 2021-04-12

   Unknown

2. CVE-2021-28834 Remote code execution in Kramdown

   Published 2021-03-19

   Critical·CVSS 9.8 EPSS 2.7%

   Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

3. DSA-4743-1 ruby-kramdown - security update

   Published 2020-08-10

   Unknown

4. DLA-2316-1 ruby-kramdown - security update

   Published 2020-08-08

   Unknown

5. CVE-2020-14001 Unintended read access in kramdown gem

   Published 2020-07-17

   Critical·CVSS 9.8 PoC

   The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `)....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.