CVE-2020-14001: Critical severity kramdown vulnerability
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= ). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-14001?
CVE-2020-14001 is a vulnerability in the kramdown gem before 2.3.0 for Ruby that allows unintended read access or unintended embedded Ruby code execution.
How severe is CVE-2020-14001?
CVE-2020-14001 has a severity rating of 9.8 (critical).
How can I fix CVE-2020-14001?
To fix CVE-2020-14001, update kramdown to version 2.3.0 or later.
What software is affected by CVE-2020-14001?
CVE-2020-14001 affects kramdown gem before 2.3.0 for Ruby.
Where can I find more information about CVE-2020-14001?
You can find more information about CVE-2020-14001 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-14001), [GitHub Commit](https://github.com/gettalong/kramdown/commit/1b8fd33c3120bfc6e5164b449e2c2fc9c9306fde), [GitHub Comparison](https://github.com/gettalong/kramdown/compare/REL_2_2_1...REL_2_3_0).