CVE-2021-28834
Remote code execution in Kramdown
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
CVE-2021-28834- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
CVE-2021-28834- Updated
- 2026-11-02
EUVDEUVD-2021-0603 No score
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
EUVD-2021-0603- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-52p9-v744-mwjj
Remote code execution in Kramdown
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
GHSA-52p9-v744-mwjj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
CVE-2021-28834- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
DEBIAN-CVE-2021-28834- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-52p9-v744-mwjj
Remote code execution in Kramdown
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
GHSA-52p9-v744-mwjj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVOESA-2021-1159
rubygem-kramdown security update
The package is fast yet-another-markdown-parser, pure Ruby, using a strict syntax definition and supporting several common extensions.
Security Fix(es):
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.(CVE-2021-28834)
- Record
OESA-2021-1159- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-28834
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
- Record
UBUNTU-CVE-2021-28834- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11336-1 No score
ruby2.7-rubygem-kramdown-2.3.1-1.3 on GA media
These are all security issues fixed in the ruby2.7-rubygem-kramdown-2.3.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11336-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12038-1 No score
ruby3.1-rubygem-kramdown-2.4.0-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-kramdown-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12038-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13161-1 No score
ruby3.2-rubygem-kramdown-2.4.0-1.8 on GA media
These are all security issues fixed in the ruby3.2-rubygem-kramdown-2.4.0-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13161-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14170-1 No score
ruby3.3-rubygem-kramdown-2.4.0-1.12 on GA media
These are all security issues fixed in the ruby3.3-rubygem-kramdown-2.4.0-1.12 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14170-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15119-1 No score
ruby3.4-rubygem-kramdown-2.4.0-1.15 on GA media
These are all security issues fixed in the ruby3.4-rubygem-kramdown-2.4.0-1.15 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15119-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10352-1 No score
ruby4.0-rubygem-kramdown-2.4.0-1.17 on GA media
These are all security issues fixed in the ruby4.0-rubygem-kramdown-2.4.0-1.17 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10352-1- Updated
- 2026-11-02
OSVUSN-6424-1 No score
ruby-kramdown vulnerability
It was discovered that kramdown did not restrict Rouge formatters to the correct namespace. An attacker could use this issue to cause kramdown to execute arbitrary code.
- Record
USN-6424-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kramdownRubyGems |
1.16.0 up to 2.3.1 | 2.3.1 |
ruby-kramdownDebian:12 |
before 2.3.0-5 | 2.3.0-5 |
ruby-kramdownDebian:13 |
before 2.3.0-5 | 2.3.0-5 |
ruby-kramdownDebian:14 |
before 2.3.0-5 | 2.3.0-5 |
ruby-kramdownDebian:10 |
before 1.17.0-1+deb10u2, plus listed versions 1.17.0-11.17.0-1+deb10u1 |
1.17.0-1+deb10u2 |
kramdownRubyGems |
1.16.0 up to 2.3.1, plus listed versions 1.16.11.16.21.17.02.0.02.0.0.beta1 Show 5 moreShow less2.0.0.beta22.1.02.2.02.2.12.3.0 |
2.3.1 |
rubygem-kramdownopenEuler:20.03-LTS-SP1 |
before 2.1.0-2.oe1 | 2.1.0-2.oe1 |
ruby-kramdownUbuntu:20.04:LTS |
before 1.17.0-4ubuntu0.2, plus listed versions 1.17.0-11.17.0-21.17.0-41.17.0-4ubuntu0.1 |
1.17.0-4ubuntu0.2 |
rubygem-kramdownopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.4.0-1.1 | 2.4.0-1.1 |
ruby3.2-rubygem-kramdownopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.4.0-1.8 | 2.4.0-1.8 |
rubygem-kramdownopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.4.0-1.12 | 2.4.0-1.12 |
rubygem-kramdownopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.4.0-1.15 | 2.4.0-1.15 |
rubygem-kramdownopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.4.0-1.17 | 2.4.0-1.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28834 is a critical vulnerability (CVSS 9.8) in Kramdown Project Kramdown, published March 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.70%, the 85th percentile. Fixed in kramdown 2.3.1.
References
github.com/gettalong/kramdown/pull/708
gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d06b4ed6ccb66
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6
Show 17 moreShow less
debian.org/security/2021/dsa-4890
nvd.nist.gov/vuln/detail/CVE-2021-28834
about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released
security-tracker.debian.org/tracker/CVE-2021-28834
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1159
ubuntu.com/security/CVE-2021-28834
cve.org/CVERecord?id=CVE-2021-28834
suse.com/security/cve/CVE-2020-14001
lists.opensuse.org/archives/list/[email protected]/thread/FZZEL5EJD5QLTIY6EGGTCXQMVMERPE6X