What is CVE-2020-14001?

CVE-2020-14001 is a critical-severity vulnerability in Kramdown Project, classified under Missing Authorization. CVSS score: 9.8/10. Published 2020-07-17.

How severe is CVE-2020-14001?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2020-14001 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Kramdown Project

CVE-2020-14001

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Vulnerability class: Broken Access Control

Published 2020-07-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.046 (91.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.046 · newest: 0.046 · change: 0.000

Affected products

Kramdown Project
Canonical Ubuntu Linux — versions 20.04
Debian Linux — versions 9.0, 10.0
Fedoraproject Fedora — versions 31, 32

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

github.com/gettalong/kramdown (Third Party Advisory)
kramdown.gettalong.org (Vendor Advisory)
rubygems.org/gems/kramdown (Third Party Advisory)
kramdown.gettalong.org/news.html (Release Notes, Vendor Advisory)
github.com/gettalong/kramdown/commit/1b8fd33c3120bfc6e5164b449e2c2fc9c9306fde (Patch, Third Party Advisory)
github.com/gettalong/kramdown/compare/REL_2_2_1...REL_2_3_0 (Patch, Third Party Advisory)
security.netapp.com/advisory/ntap-20200731-0004/ (Third Party Advisory)
lists.apache.org/thread.html/r96df7899fbb456fe2705882f710a0c8e8614b573fbffd8d12… (mailing-list)
lists.debian.org/debian-lts-announce/2020/08/msg00014.html (mailing-list, Mailing List, Third Party Advisory)
www.debian.org/security/2020/dsa-4743 (vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2020-14001?: CVE-2020-14001 is a critical-severity vulnerability in Kramdown Project, classified under Missing Authorization. CVSS score: 9.8/10. Published 2020-07-17.
How severe is CVE-2020-14001?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-14001 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.