GitHub Advisoryadvisory · RubyGems

GHSA-52p9-v744-mwjj Remote code execution in Kramdown

HIGH Published 2021-03-29 Modified 2021-03-31 Official page ↗
Aliases
CVE-2021-28834
Ecosystem
RubyGems
Packages
kramdown
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2021-03-22

Affected packages

• RubyGems kramdown: >= 1.16.0, < 2.3.1 → fixed in 2.3.1

Description

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

Related

Alias · CVE (1)

  • CVE-2021-28834 Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References