Skip to content
OpenAdvisories
Critical USN-4562-1 1 CVE

ruby-kramdown vulnerability

Published Sep 30, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that kramdown insecurely handled certain crafted input.
An attacker could use this vulnerability to read restricted files or
execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ruby-kramdown 1.17.0-4ubuntu0.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-14001

    Unintended read access in kramdown gem

    The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with templ…

    icinga2 ruby-kramdown kramdown ruby-kramdown Debian Ubuntu Alpine RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2020-14001