Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016633 advisory.

    Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus
    arbitrary classes can be instantiated. (CVE-2021-28834)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6424-1 advisory.

    It was discovered that kramdown did not restrict Rouge formatters to the correct namespace. An attacker     could use this issue to cause kramdown to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Stan Hu discovered that kramdown, a pure Ruby Markdown parser and converter, performed insufficient namespace validation of Rouge syntax highlighting formatters.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-4c57a892d1 advisory.

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated. (CVE-2021-28834)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-edc673e864 advisory.

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated. (CVE-2021-28834)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
316239	Unity Linux 20.1060e / 20.1070e Security Update: rubygem-kramdown (UTSA-2026-016633)	Nessus	Unity Linux Local Security Checks	Local	critical
410513	SCA: security update for kramdown (GHSA-52p9-v744-mwjj)	Tenable Cloud Security	SCA Checks	Local	critical
410513	SCA: security update for kramdown (GHSA-52p9-v744-mwjj)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
182817	Ubuntu 20.04 LTS : kramdown vulnerability (USN-6424-1)	Nessus	Ubuntu Local Security Checks	Local	critical
148536	Debian DSA-4890-1 : ruby-kramdown - security update	Nessus	Debian Local Security Checks	Local	critical
148232	Fedora 33 : rubygem-kramdown (2021-4c57a892d1)	Nessus	Fedora Local Security Checks	Local	critical
148230	Fedora 32 : rubygem-kramdown (2021-edc673e864)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2021-28834

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical