PatchTheCVEkramdown vulnerabilities and fixes
Recent CVEs affecting kramdown, with upgrade or downgrade steps. 2 tracked.
kramdown has 2 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-03-19. Highest priority: CVE-2021-28834 (score 71/100).
- CVE-2021-28834 CRITICAL 9.8 UPGRADE MITIGATE Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrar
- CVE-2020-14001 CRITICAL 9.8 UPGRADE MITIGATE The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, whi
FAQ
How do I fix kramdown vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is kramdown being exploited right now?
None of the tracked kramdown CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which kramdown CVE should I patch first?
CVE-2021-28834 currently ranks highest (71/100): Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrar.