Most recent entries from all

bdu:2022-00305

2026-10-23T00:16:14.945210+00:00

bdu:2022-00305

BREW-um-CVE-2021-28834 — Remote code execution in Kramdown

2026-10-23T00:16:14.945250+00:00

Affected: Homebrew: um

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

EUVD-2026-26105

2026-10-23T00:16:14.945299+00:00

EUVD-2026-26105

fkie_cve-2021-28834

2026-10-23T00:16:14.945328+00:00

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

GHSA-52p9-v744-mwjj — Remote code execution in Kramdown

2026-10-23T00:16:14.945368+00:00

Affected: RubyGems: kramdown

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

gsd-2021-28834

2026-10-23T00:16:14.945400+00:00

gsd-2021-28834

OESA-2021-1159 — rubygem-kramdown security update

2026-10-23T00:16:14.945418+00:00

Affected: openEuler:20.03-LTS-SP1: rubygem-kramdown

The package is fast yet-another-markdown-parser, pure Ruby, using a strict syntax definition and supporting several common extensions. Security Fix(es): Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.(CVE-2021-28834)

openSUSE-SU-2024:11336-1 — ruby2.7-rubygem-kramdown-2.3.1-1.3 on GA media

2026-10-23T00:16:14.945453+00:00

ruby2.7-rubygem-kramdown-2.3.1-1.3 on GA media

UBUNTU-CVE-2021-28834

2026-10-23T00:16:14.945532+00:00

Affected: Ubuntu:20.04:LTS: ruby-kramdown

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.