{"id":"CVE-2021-28834","aliases":["GHSA-52p9-v744-mwjj"],"url":"https://o3.security/vulnerability/CVE-2021-28834","summary":"Remote code execution in Kramdown","details":"Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.","published":"2021-03-19T07:15:13.147Z","modified":"2026-07-08T06:26:50.539793266Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"kramdown","fixedVersion":"2.3.1"}],"fix":{"url":"https://github.com/gettalong/kramdown/pull/708","label":"gettalong/kramdown#708"},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGV/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPR/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4890"},{"type":"FIX","url":"https://github.com/gettalong/kramdown/compare/REL_2_3_0...REL_2_3_1"},{"type":"FIX","url":"https://gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d06b4ed6ccb66"},{"type":"EVIDENCE","url":"https://github.com/gettalong/kramdown/pull/708"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:26:50.539793266Z"}}