CVE-2021-28834
Published Mar 19, 2021Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
Vendor/product archive
kramdown_project / kramdown CVEs
Beta · best-effort2 CVEs tagged to kramdown_project / kramdown — 2 Critical, 0 High, 0 Medium, 0 Low, 0 Unrated.
CVE-2020-14001
Published Jul 17, 2020The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or…
Showing 1-2 of 2 CVEsPage 1 of 1