CVE-2020-14001

The vulnerability CVE-2020-14001 affects the kramdown Ruby gem prior to 2.3.0, where the template option is processed by default in Kramdown documents. This can allow unintended read access (e.g., template="/etc/passwd") or unintended embedded Ruby code execution (e.g., template="string://<%= ...

CVE-2021-28834

Kramdown before 2.3.1 does not constrain Rouge formatters to Rouge::Formatters, allowing arbitrary class instantiation and potential code execution. Exploitation details are not provided in the documents; affected packages include kramdown/ruby-kramdown across Linux distros (e.g., Fedora, Debian,...