The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016646 advisory.

    The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default,     which allows unintended read access (such as template=/etc/passwd) or unintended embedded Ruby code     execution (such as a string that begins with template=string://<%= `). NOTE: kramdown is used in Jekyll,     GitLab Pages, GitHub Pages, and Thredded Forum.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default,     which allows unintended read access (such as template=/etc/passwd) or unintended embedded Ruby code     execution (such as a string that begins with template=string://<%= `). NOTE: kramdown is used in Jekyll,     GitLab Pages, GitHub Pages, and Thredded Forum. (CVE-2020-14001)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default,
    which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code
    execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll,
    GitLab Pages, GitHub Pages, and Thredded Forum. (CVE-2020-14001)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3259-1 advisory.

    - CVE-2020-14001: Fixed processing template options inside documents allowing unintended read access or     embedded Ruby code execution (bsc#1174297).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4562-2 advisory.

    kramdown could be made to crash, run programs, or leak sensitive information if it opened a specially     crafted file.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4562-1 advisory.

    It was discovered that kramdown insecurely handled certain crafted input. An attacker could use this     vulnerability to read restricted files or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A security flaw was found on ruby kramdown which may lead to unintended code execution. This vulnerability is now assigned as CVE-2020-14001 . This new rpm should fix this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security flaw was found on ruby kramdown which may lead to unintended code execution. THis vulnerability is now assigned as CVE-2020-14001 . This new rpm should fix this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in ruby-kramdown, a fast, pure ruby, Markdown parser and converter, which could result in unintended read access to files or unintended embedded Ruby code execution when the {::options /} extension is used together with the 'template' option.

The update introduces a new option 'forbidden_inline_options' to restrict the options allowed with the {::options /} extension. By default the 'template' option is forbidden.

ruby-kramdown processes the template option inside Kramdown documents by default, which allows unintended read access (such as template='/etc/passwd') or unintended embedded Ruby code execution (such as a string that begins with template='string://<%= `). NOTE:
kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

For Debian 9 stretch, this problem has been fixed in version 1.12.0-1+deb9u1.

We recommend that you upgrade your ruby-kramdown packages.

For the detailed security status of ruby-kramdown please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-kramdown

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gitlab reports :

Arbitrary File Read when Moving an Issue

Memory Exhaustion via Excessive Logging of Invite Email Error

Denial of Service Through Project Import Feature

User Controlled Git Configuration Settings Resulting in SSRF

Stored XSS in Issue Reference Number Tooltip

Stored XSS in Issues List via Milestone Title

Improper Access Control After Group Transfer

Bypass Email Verification Required for OAuth Flow

Confusion When Using Hexadecimal Branch Names

Insufficient OAuth Revocation

Improper Access Control for Project Sharing

Stored XSS in Jobs Page

Improper Access Control of Applications Page

SSRF into Shared Runner

Update Kramdown Gem

kramdown news :

CVE-2020-14001 is addressed to avoid problems when using the {::options /} extension together with the 'template' option.

ID	Name	Product	Family	Type	Severity
316184	Unity Linux 20.1060e / 20.1070e Security Update: rubygem-kramdown (UTSA-2026-016646)	Nessus	Unity Linux Local Security Checks	Local	critical
253790	Linux Distros Unpatched Vulnerability : CVE-2020-14001	Nessus	Misc.	Local	critical
417095	SCA: security update for kramdown (GHSA-mqm2-cgpr-p4m6)	Tenable Cloud Security	SCA Checks	Local	critical
417095	SCA: security update for kramdown (GHSA-mqm2-cgpr-p4m6)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
404920	Alpine: multiple icinga2 packages: security update to 2.11.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
404920	Alpine: multiple icinga2 packages: security update to 2.11.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
400421	Alpine: multiple icinga2 packages: security update to 2.11.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
400421	Alpine: multiple icinga2 packages: security update to 2.11.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
164981	SUSE SLES15: ruby2.5-rubygem-kramdown / ruby2.5-rubygem-kramdown-doc / etc (SUSE-SU-2022:3259-1)	Nessus	SuSE Local Security Checks	Local	critical
141922	Ubuntu 20.10 : kramdown vulnerability (USN-4562-2)	Nessus	Ubuntu Local Security Checks	Local	critical
141095	Ubuntu 20.04 LTS : kramdown vulnerability (USN-4562-1)	Nessus	Ubuntu Local Security Checks	Local	critical
139713	Fedora 32 : rubygem-kramdown (2020-f6eee9a2d3)	Nessus	Fedora Local Security Checks	Local	critical
139708	Fedora 31 : rubygem-kramdown (2020-5c70d97eca)	Nessus	Fedora Local Security Checks	Local	critical
139521	Debian DSA-4743-1 : ruby-kramdown - security update	Nessus	Debian Local Security Checks	Local	critical
139427	Debian DLA-2316-1 : ruby-kramdown security update	Nessus	Debian Local Security Checks	Local	critical
139394	FreeBSD : Gitlab -- Multiple Vulnerabilities (a003b74f-d7b3-11ea-9df1-001b217b3468)	Nessus	FreeBSD Local Security Checks	Local	critical
138245	FreeBSD : kramdown -- template option vulnerability (20b46222-c12b-11ea-abe8-08002728f74c)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2020-14001

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical