vmg/redcarpet

vmg/redcarpet

Releases27

Frequency6 months 1 week

Last Release over 1 year ago

Stars5.08K

The safe Markdown parser, reloaded.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2020-26298 ↗	Jan 11, 2021Monday, 11 January 2021, 19:15	6.8 MEDIUM	3.5 LOW
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
CVE-2015-5147 ↗	Jul 14, 2015Tuesday, 14 July 2015, 16:59	—	7.5 HIGH
Stack-based buffer overflow in the header_anchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.