Kramdown Project Kramdown 0.14.2 for Ruby

CPE Details

Kramdown Project Kramdown 0.14.2 for Ruby
kramdown_project
kramdown
0.14.2
2020-07-22
17h51 +00:00
2020-07-22
17h51 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:kramdown_project:kramdown:0.14.2:*:*:*:*:ruby:*:*

Informations

Vendor

kramdown_project

Product

kramdown

Version

0.14.2

Target Software

ruby

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-28834 2021-03-19 05h51 +00:00 Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
9.8
Critical
CVE-2020-14001 2020-07-17 13h27 +00:00 The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
9.8
Critical