Critical DSA-4890-1 1 CVE

ruby-kramdown - security update

Published Apr 12, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	ruby-kramdown	1.17.0-1+deb10u2

Vulnerabilities 1

Critical 9.8

CVE-2021-28834

Remote code execution in Kramdown

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

kramdown ruby-kramdown ruby-kramdown Debian Ubuntu RubyGems

Mar 19, 2021