PatchTheCVEkramdown project vulnerabilities
Recent CVEs affecting kramdown project products. 2 tracked.
kramdown project has 2 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-03-19. Highest priority: CVE-2021-28834 (score 71/100).
- CVE-2021-28834 CRITICAL 9.8 UPGRADE MITIGATE Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrar
- CVE-2020-14001 CRITICAL 9.8 UPGRADE MITIGATE The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, whi
FAQ
How do I fix kramdown project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is kramdown project being exploited right now?
None of the tracked kramdown project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which kramdown project CVE should I patch first?
CVE-2021-28834 currently ranks highest (71/100): Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrar.