Kramdown Project

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Kramdown Project records in CISA KEV

No Kramdown Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Kramdown 2 records MEDIUM

Records

2 records in Kramdown · all components

TI-2020-10968 CVE-2020-14001 · GHSA-mqm2-cgpr-p4m6

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown…

MEDIUM 49

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0456 Published 2020-07-17 Fixed in 2.3.0 CWE-862

TI-2021-09825 CVE-2021-28834 · GHSA-52p9-v744-mwjj

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters…

MEDIUM 47

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02695 Published 2021-03-19 Fixed in 2.3.1 CWE-94

Open these records in search →

Critical	2
High	0
Medium	0
Low	0
No CVSS	0