Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-28834

30
FAUCET Score

CVE-2021-28834 is a critical vulnerability in Kramdown versions prior to 2.3.1, affecting various Debian and Fedora distributions, where it fails to restrict Rouge formatters, allowing arbitrary class instantiation. With a CVSS score of 9.8, this network-exploitable vulnerability is easily executed without user interaction and can lead to complete compromise of confidentiality, integrity, and availability. Currently, there is no public exploit code available, nor is there evidence of active exploitation or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.3.1CPE matchmatch criteria
cpe:2.3:a:kramdown_project:kramdown:*:*:*:*:*:ruby:*:*
32CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
33CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
34CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
10.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.80%
Probability of exploitation in next 30 days
EPSS Percentile
85.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0280 is in the 76th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
rubygemspatch availablevia ghsa
Product: kramdownFixed in: 2.3.1

Vendor Advisories (2)

rubygemsGHSA-52p9-v744-mwjjhigh

Remote code execution in Kramdown

Mar 29, 2021
redhatCVE-2021-28834Moderate

rubygem-kramdown: allows arbitrary classes to be instantiated

Mar 14, 2021

References

github.com / gettalong/kramdown/compare/REL_2_3_0...REL_2_3_1
PatchThird Party Advisory
github.com / gettalong/kramdown/pull/708
ExploitThird Party Advisory
gitlab.com / gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d06b4ed6ccb66
PatchThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/NJCJVYHPY6LNUFM6LYZIAUIYOMVT5QGV
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/S3BBLUIDCUUR3NEE4NJLOCCAV3ALQ3O6
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/SYOLQKFL6IJCQLBXV34Z4TI4O54GESPR
debian.org / security/2021/dsa-4890
Third Party Advisory