← All advisories

Critical severity9.8NVD Advisory· Published Mar 19, 2021· Updated Jun 17, 2026

CVE-2021-28834

CVE-2021-28834

Description

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
kramdownRubyGems	>= 1.16.0, < 2.3.1	2.3.1

Affected products

9

Kramdown Project/Kramdown
cpe:2.3:a:kramdown_project:kramdown:*:*:*:*:*:ruby:*:*
Range: <2.3.1
Debian/linux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Fedoraproject/Fedora3 versions
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Kramdown/Kramdowndescription
ghsa-coords3 versions
pkg:gem/kramdown pkg:rpm/opensuse/ruby3.2-rubygem-kramdown&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/rubygem-kramdown&distro=openSUSE%20Tumbleweed
>= 1.16.0, < 2.3.1+ 2 more
- (no CPE)range: >= 1.16.0, < 2.3.1
- (no CPE)range: < 2.4.0-1.8
- (no CPE)range: < 2.4.0-1.1

Patches

Vulnerability mechanics

References

15

github.com/gettalong/kramdown/compare/REL_2_3_0...REL_2_3_1nvdPatchThird Party AdvisoryWEB
gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d06b4ed6ccb66nvdPatchThird Party AdvisoryWEB
github.com/gettalong/kramdown/pull/708nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-52p9-v744-mwjjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-28834ghsaADVISORY
www.debian.org/security/2021/dsa-4890nvdThird Party AdvisoryWEB
about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/ghsaWEB
github.com/stanhu/kramdown/commit/d6a1cbcb2caa2f8a70927f176070d126b2422760ghsaWEB
github.com/stanhu/kramdown/commit/ff0218aefcf00cd5a389e17e075d36cd46d011e2ghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGVghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6ghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPRghsaWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGV/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPR/nvd

News mentions

0

No linked articles in our index yet.