{"id":"CVE-2021-28834","aliases":["DEBIAN-CVE-2021-28834","DSA-4890-1","EUVD-2021-0603","GHSA-52p9-v744-mwjj","OESA-2021-1159","UBUNTU-CVE-2021-28834","USN-6424-1","openSUSE-SU-2024:11336-1","openSUSE-SU-2024:12038-1","openSUSE-SU-2024:13161-1","openSUSE-SU-2024:14170-1","openSUSE-SU-2025:15119-1","openSUSE-SU-2026:10352-1"],"status":"published","title":"Remote code execution in Kramdown","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02695,"percentile":0.86029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2021-03-19T06:51:15Z","modified":"2026-10-24T10:50:41Z","fixes":[{"ecosystem":"RubyGems","package":"kramdown","fixed_in":["2.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-kramdown","fixed_in":["2.3.0-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-kramdown","fixed_in":["2.3.0-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-kramdown","fixed_in":["2.3.0-5"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-kramdown","fixed_in":["1.17.0-1+deb10u2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-kramdown","fixed_in":["2.1.0-2.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ruby-kramdown","fixed_in":["1.17.0-4ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"2.3.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-5"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-1+deb10u2"}]}],"versions":["1.17.0-1","1.17.0-1+deb10u1"]},{"source":"osv","ecosystem":"RubyGems","package":"kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"2.3.1"}]}],"versions":["1.16.0","1.16.1","1.16.2","1.17.0","2.0.0","2.0.0.beta1","2.0.0.beta2","2.1.0","2.2.0","2.2.1","2.3.0"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2.oe1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-4ubuntu0.2"}]}],"versions":["1.17.0-1","1.17.0-2","1.17.0-4","1.17.0-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-4ubuntu0.2"}]}],"versions":["1.17.0-1","1.17.0-2","1.17.0-4","1.17.0-4ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.8"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.12"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.15"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-kramdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.17"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"kramdown_project","product":"kramdown"}],"references":[{"url":"https://github.com/gettalong/kramdown/pull/708","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d06b4ed6ccb66","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/gettalong/kramdown/compare/REL_2_3_0...REL_2_3_1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGV/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2021/dsa-4890","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28834","tags":["advisory"]},{"url":"https://github.com/stanhu/kramdown/commit/d6a1cbcb2caa2f8a70927f176070d126b2422760","tags":["web"]},{"url":"https://github.com/stanhu/kramdown/commit/ff0218aefcf00cd5a389e17e075d36cd46d011e2","tags":["web"]},{"url":"https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/#remote-code-execution-via-unsafe-user-controlled-markdown-rendering-options","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGV/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPR/"},{"url":"https://github.com/advisories/GHSA-52p9-v744-mwjj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28834","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGV","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPR","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1159","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28834","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6424-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28834","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28834","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FZZEL5EJD5QLTIY6EGGTCXQMVMERPE6X/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-28834","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-19T06:51:15Z","modified":"2024-08-03T21:55:11.772Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-0603","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-19T06:51:15Z","modified":"2024-08-03T21:55:11Z","updated_at":"2026-11-03T03:24:46.117926Z"}],"ghsa":[{"id":"GHSA-52p9-v744-mwjj","title":"Remote code execution in Kramdown","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-29T16:30:34Z","modified":"2023-02-01T05:05:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:32.918681Z"}],"nvd":[{"id":"CVE-2021-28834","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-19T07:15:13.147Z","modified":"2026-06-17T03:46:57.807Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"CVE-2021-28834","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-19T07:15:13.147Z","modified":"2026-10-24T10:50:41.869031094Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28834","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-19T07:15:13.147Z","modified":"2026-10-23T18:03:12.653117811Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-52p9-v744-mwjj","title":"Remote code execution in Kramdown","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-29T16:30:34Z","modified":"2024-02-17T05:35:38.398887Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"OESA-2021-1159","title":"rubygem-kramdown security update","description":"The package is fast yet-another-markdown-parser, pure Ruby, using a strict syntax definition and supporting several common extensions.\r\n\r\nSecurity Fix(es):\r\n\r\nKramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.(CVE-2021-28834)","status":"published","published":"2021-05-06T11:04:23Z","modified":"2026-08-18T01:15:12.648940609Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-28834","description":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","status":"published","published":"2021-03-19T07:15:00Z","modified":"2026-02-04T04:21:42.147987Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DSA-4890-1","title":"ruby-kramdown - security update","status":"published","published":"2021-04-12T00:00:00Z","modified":"2026-03-09T02:08:57.816941Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2024:11336-1","title":"ruby2.7-rubygem-kramdown-2.3.1-1.3 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-kramdown-2.3.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:14.485929Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12038-1","title":"ruby3.1-rubygem-kramdown-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-kramdown-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:27.842617Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:13161-1","title":"ruby3.2-rubygem-kramdown-2.4.0-1.8 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-kramdown-2.4.0-1.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:54:14.570644Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14170-1","title":"ruby3.3-rubygem-kramdown-2.4.0-1.12 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-kramdown-2.4.0-1.12 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:33:41.772393Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15119-1","title":"ruby3.4-rubygem-kramdown-2.4.0-1.15 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-kramdown-2.4.0-1.15 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T03:30:48.588249Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10352-1","title":"ruby4.0-rubygem-kramdown-2.4.0-1.17 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-kramdown-2.4.0-1.17 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.560171Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"USN-6424-1","title":"ruby-kramdown vulnerability","description":"It was discovered that kramdown did not restrict Rouge formatters to the\ncorrect namespace. An attacker could use this issue to cause kramdown to\nexecute arbitrary code.\n","status":"published","published":"2023-10-10T04:39:08Z","modified":"2026-02-10T04:43:22Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}