ADVISORIES

• CVE-2021-28834 (NVD)
• GHSA-52p9-v744-mwjj

GEM

kramdown

SEVERITY

CVSS v3.x: 9.8 (Critical)

UNAFFECTED VERSIONS

• < 1.16.0

PATCHED VERSIONS

• >= 2.3.1

DESCRIPTION

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

RELATED

• https://github.com/gettalong/kramdown/pull/708
• https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/#remote-code-execution-via-unsafe-user-controlled-markdown-rendering-options