Search for packages
| purl | pkg:gem/kramdown@0.12.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-11sx-kmkx-h3fw
Aliases: CVE-2021-28834 GHSA-52p9-v744-mwjj |
Remote code execution in Kramdown Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. |
Affected by 0 other vulnerabilities. |
|
VCID-wn5q-f98x-1bgu
Aliases: CVE-2020-14001 GHSA-mqm2-cgpr-p4m6 |
Unintended read access in kramdown gem The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-05-30T04:36:18.441664+00:00 | GitLab Importer | Affected by | VCID-11sx-kmkx-h3fw | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/kramdown/CVE-2021-28834.yml | 38.6.0 |
| 2026-05-30T04:21:00.568702+00:00 | GitLab Importer | Affected by | VCID-wn5q-f98x-1bgu | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/kramdown/CVE-2020-14001.yml | 38.6.0 |