Kramdown is a lightweight Markdown processor widely embedded in static site generators and documentation toolchains, with vulnerabilities concentrating in its core parsing and authorization mechanisms. The observed weakness classes center on input validation and access-control gaps that reflect the product's role in translating user-supplied markup into rendered content. Current CVE counts, severity, and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Kramdown Project over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-14001CRITICAL The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or u | Jul 17, 2020 | 9.8 | 33 | NO | NO |
CVE-2021-28834CRITICAL Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. | Mar 19, 2021 | 9.8 | 30 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Kramdown Project.
Media articles that mention a CVE ID that affects a product developed by Kramdown Project — matched by CVE ID, not by vendor name.