~ / search / GHSA-52p9-v744-mwjj

GHSA-52p9-v744-mwjj

Remote code execution in Kramdown

Source: GitHub Advisory Database (reviewed) High CVE-2021-28834

Packages

EcosystemPackageAffectedFixed in
RubyGems kramdown >= 1.16.0, < 2.3.1 2.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

References

External links from the advisory. They lead to third-party sites.