security: Code Injection in kramdown

Issue created from vulnerability 7797534

Description:

Kramdown does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

• Severity: critical
• Confidence: unknown
• Location: Gemfile.lock

Solution:

Upgrade to version 2.3.1 or above.

Identifiers:

• Gemnasium-2ffcaeb9-2d87-49b9-879d-edc000ac0988
• CVE-2021-28834

Links:

• https://nvd.nist.gov/vuln/detail/CVE-2021-28834

Scanner:

• Name: Gemnasium