Every CVE Search/ Get API key

CVE-2020-14001

Unintended read access in kramdown gem

9.8 CriticalFix available

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.56%Down 14.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
CVE-2020-14001
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-862
Updated
2026-11-02
CVE List No score

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
CVE-2020-14001
Updated
2026-11-02
EUVDEUVD-2020-0635 No score

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
EUVD-2020-0635
Updated
2026-11-03
GitHub AdvisoriesGHSA-mqm2-cgpr-p4m6 9.8

Unintended read access in kramdown gem

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
GHSA-mqm2-cgpr-p4m6
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
OSVALPINE-CVE-2020-14001 9.8

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
ALPINE-CVE-2020-14001
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.8

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
CVE-2020-14001
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2020-14001 9.8

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
DEBIAN-CVE-2020-14001
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-mqm2-cgpr-p4m6 9.8

Unintended read access in kramdown gem

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
GHSA-mqm2-cgpr-p4m6
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
OSVOESA-2021-1280 9.8

rubygem-kramdown security update

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions.

Security Fix(es):

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.(CVE-2020-14001)

Record
OESA-2021-1280
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-14001 9.8

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Record
UBUNTU-CVE-2020-14001
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11336-1 No score

ruby2.7-rubygem-kramdown-2.3.1-1.3 on GA media

These are all security issues fixed in the ruby2.7-rubygem-kramdown-2.3.1-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11336-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12038-1 No score

ruby3.1-rubygem-kramdown-2.4.0-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-kramdown-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12038-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13161-1 No score

ruby3.2-rubygem-kramdown-2.4.0-1.8 on GA media

These are all security issues fixed in the ruby3.2-rubygem-kramdown-2.4.0-1.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13161-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14170-1 No score

ruby3.3-rubygem-kramdown-2.4.0-1.12 on GA media

These are all security issues fixed in the ruby3.3-rubygem-kramdown-2.4.0-1.12 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14170-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15119-1 No score

ruby3.4-rubygem-kramdown-2.4.0-1.15 on GA media

These are all security issues fixed in the ruby3.4-rubygem-kramdown-2.4.0-1.15 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15119-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10352-1 No score

ruby4.0-rubygem-kramdown-2.4.0-1.17 on GA media

These are all security issues fixed in the ruby4.0-rubygem-kramdown-2.4.0-1.17 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10352-1
Updated
2026-11-02
OSVSUSE-SU-2022:3259-1 No score

Security update for rubygem-kramdown

This update for rubygem-kramdown fixes the following issues:

  • CVE-2020-14001: Fixed processing template options inside documents allowing unintended read access or embedded Ruby code execution (bsc#1174297).
Record
SUSE-SU-2022:3259-1
Updated
2026-11-02
OSVUSN-4562-1 No score

ruby-kramdown vulnerability

It was discovered that kramdown insecurely handled certain crafted input. An attacker could use this vulnerability to read restricted files or execute arbitrary code.

Record
USN-4562-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kramdown
RubyGems
 before 2.3.0
2.3.0
icinga2
Alpine:v3.12
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.13
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.14
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.15
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.16
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.17
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.18
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.19
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.20
 before 2.11.3-r1
2.11.3-r1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
icinga2
Alpine:v3.21
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.22
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.23
 before 2.11.3-r1
2.11.3-r1
icinga2
Alpine:v3.24
 before 2.11.3-r1
2.11.3-r1
ruby-kramdown
Debian:12
 before 2.3.0-3
2.3.0-3
ruby-kramdown
Debian:13
 before 2.3.0-3
2.3.0-3
ruby-kramdown
Debian:14
 before 2.3.0-3
2.3.0-3
ruby-kramdown
Debian:9
 before 1.12.0-1+deb9u1, plus listed versions
1.12.0-1
1.12.0-1+deb9u1
ruby-kramdown
Debian:10
 before 1.17.0-1+deb10u1, plus listed versions
1.17.0-1
1.17.0-1+deb10u1
kramdown
RubyGems
 before 2.3.0, plus listed versions
0.1.00.10.00.11.00.12.00.13.1
Show 45 moreShow less
0.13.20.13.30.13.40.13.50.13.60.13.70.13.80.14.00.14.10.14.20.2.00.3.00.4.00.5.00.6.00.7.00.8.00.9.01.0.01.0.11.0.21.1.01.10.01.11.01.11.11.12.01.13.01.13.11.13.21.14.01.15.01.16.01.16.11.16.21.17.01.2.01.3.01.3.11.3.21.3.31.4.01.4.11.4.21.5.01.6.0
2.3.0
rubygem-kramdown
openEuler:20.03-LTS-SP1
 before 2.1.0-3.oe1
2.1.0-3.oe1
rubygem-kramdown
openEuler:20.03-LTS-SP2
 before 2.1.0-3.oe1
2.1.0-3.oe1
rubygem-kramdown
SUSE:Linux Enterprise High Availability Extension 15
 before 1.15.0-150000.3.3.1
1.15.0-150000.3.3.1
rubygem-kramdown
SUSE:Linux Enterprise High Availability Extension 15 SP1
 before 1.15.0-150000.3.3.1
1.15.0-150000.3.3.1
rubygem-kramdown
SUSE:Linux Enterprise High Availability Extension 15 SP2
 before 1.15.0-150000.3.3.1
1.15.0-150000.3.3.1
rubygem-kramdown
SUSE:Linux Enterprise High Availability Extension 15 SP3
 before 1.15.0-150000.3.3.1
1.15.0-150000.3.3.1
rubygem-kramdown
SUSE:Linux Enterprise High Availability Extension 15 SP4
 before 1.15.0-150000.3.3.1
1.15.0-150000.3.3.1
rubygem-kramdown
openSUSE:Leap 15.3
 before 1.15.0-150000.3.3.1
1.15.0-150000.3.3.1
rubygem-kramdown
openSUSE:Leap 15.4
 before 1.15.0-150000.3.3.1
1.15.0-150000.3.3.1
ruby-kramdown
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.8.0-11.10.0-1
 None known
ruby-kramdown
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.14.0-11.15.0-1
 None known
ruby-kramdown
Ubuntu:20.04:LTS
 before 1.17.0-4ubuntu0.1, plus listed versions
1.17.0-11.17.0-21.17.0-4
1.17.0-4ubuntu0.1
rubygem-kramdown
openSUSE:Tumbleweed
 before 2.4.0-1.1
2.4.0-1.1
ruby3.2-rubygem-kramdown
openSUSE:Tumbleweed
 before 2.4.0-1.8
2.4.0-1.8
rubygem-kramdown
openSUSE:Tumbleweed
 before 2.4.0-1.12
2.4.0-1.12
rubygem-kramdown
openSUSE:Tumbleweed
 before 2.4.0-1.15
2.4.0-1.15
rubygem-kramdown
openSUSE:Tumbleweed
 before 2.4.0-1.17
2.4.0-1.17

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-14001 is a critical vulnerability (CVSS 9.8) in Kramdown Project Kramdown, published July 17, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.56%, the 91st percentile. Fixed in kramdown 2.3.0.

References

Show 25 moreShow less
This page doesn't list everything

Left out here: 9 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open