Kramdown Project: >> Kramdown >> 2.3.0 Security Vulnerabilities
Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
CVSS Score
9.8
EPSS Score
0.015
Published
2021-03-19