Kramdown_project Kramdown
2 CVEs affecting Kramdown_project Kramdown. Latest disclosed: 2021-03-19. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28834 | Critical | 9.8 | 2021-03-19 | Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. |
CVE-2020-14001 | Critical | 9.8 | 2020-07-17 | The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as templat… |