There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus
    arbitrary classes can be instantiated. (CVE-2021-28834)

Stan Hu 發現，純 Ruby Markdown 剖析器和轉換器 kramdown 未對醒目提示格式化程式的 Rouge 語法執行充分的命名空間驗證。

遠端 Ubuntu 20.04 LTS 主機上安裝的套件受到 USN-6424-1 公告中所提及的一個弱點影響。

  - 2.3.1 之前的 Kramdown 未將 Rouge 格式子限制為 Rouge：: 格式子命名空間，因此可以具現化任意類別。 (CVE-2021-28834)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Stan Hu 发现，纯 Ruby Markdown 解析器和转换器 kramdown 对 Rouge 语法突出显示格式化程序执行的命名空间验证不足。

远程 Ubuntu 20.04 LTS 主机上安装的程序包受到 USN-6424-1 公告中提及的漏洞的影响。

  - 2.3.1 版本之前的 Kramdown 没有将 Rouge 格式化程序限制为 Rouge：: 格式化程序命名空间，因此可以实例化任意类。(CVE-2021-28834)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

Stan Hu 氏が、純粋な Ruby Markdown パーサーおよびコンバーターである kramdown が、Rouge 構文ハイライトフォーマッターの名前空間検証を十分に行っていないことを発見しました。

リモートの Ubuntu 20.04 LTS ホストには、USN-6424-1 のアドバイザリに記載された脆弱性の影響を受けるパッケージがインストールされています。

  - 2.3.1 以前の Kramdown は、Rouge formatters を Rouge に制限しません: : Formatters 名前空間。このため、任意のクラスがインスタンス化される可能性があります。(CVE-2021-28834)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Stan Hu discovered that kramdown, a pure Ruby Markdown parser and converter, performed insufficient namespace validation of Rouge syntax highlighting formatters.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6424-1 advisory.

    It was discovered that kramdown did not restrict Rouge formatters to the correct namespace. An attacker     could use this issue to cause kramdown to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-4c57a892d1 advisory.

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated. (CVE-2021-28834)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-edc673e864 advisory.

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated. (CVE-2021-28834)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016633 advisory.

    Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
410513	SCA: security update for kramdown (GHSA-52p9-v744-mwjj)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	critical
410513	SCA: security update for kramdown (GHSA-52p9-v744-mwjj)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	critical
148536	Debian DSA-4890-1：ruby-kramdown - 安全性更新	Nessus	Debian Local Security Checks	2021/4/14	2024/1/12	critical
182817	Ubuntu 20.04 LTS：kramdown 弱點 (USN-6424-1)	Nessus	Ubuntu Local Security Checks	2023/10/10	2024/8/28	critical
148536	Debian DSA-4890-1：ruby-kramdown - 安全更新	Nessus	Debian Local Security Checks	2021/4/14	2024/1/12	critical
182817	Ubuntu 20.04 LTS：kramdown 漏洞 (USN-6424-1)	Nessus	Ubuntu Local Security Checks	2023/10/10	2024/8/28	critical
148536	DebianDSA-4890-1：ruby-kramdown - セキュリティ更新	Nessus	Debian Local Security Checks	2021/4/14	2024/1/12	critical
182817	Ubuntu 20.04 LTS: kramdown の脆弱性（USN-6424-1）	Nessus	Ubuntu Local Security Checks	2023/10/10	2024/8/28	critical
148536	Debian DSA-4890-1 : ruby-kramdown - security update	Nessus	Debian Local Security Checks	2021/4/14	2024/1/12	critical
182817	Ubuntu 20.04 LTS : kramdown vulnerability (USN-6424-1)	Nessus	Ubuntu Local Security Checks	2023/10/10	2024/8/28	critical
148232	Fedora 33 : rubygem-kramdown (2021-4c57a892d1)	Nessus	Fedora Local Security Checks	2021/3/30	2024/1/8	critical
148230	Fedora 32 : rubygem-kramdown (2021-edc673e864)	Nessus	Fedora Local Security Checks	2021/3/30	2024/1/8	critical
316239	Unity Linux 20.1060e / 20.1070e Security Update: rubygem-kramdown (UTSA-2026-016633)	Nessus	Unity Linux Local Security Checks	2026/5/22	2026/5/22	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical