CVE-2021-28796

CVE-2021-28796 affects Qiita::Markdown (Ruby) prior to 0.33.0, allowing XSS via transformers. The issue is documented across multiple connected sources (e.g., Red Hat CVEs, OSV/GHSA advisories) as a failure to sanitize or neutralize user-controlled input in the transformer path, leading to cross-...

CVE-2021-28833

Qiita-Markdown (Ruby gem) up to versions before 0.34.0 is vulnerable to cross-site scripting via crafted gist links (CVE-2021-28833). Red Hat advisories and RubySec confirm this as a separate issue from CVE-2021-28796 and describe the same general class of XSS in the transformer/gist handling pat...