vmg/redcarpet

vmg/redcarpet

on GitHub

https://github.com/vmg/redcarpet

26 releases

new releases every 5 months 2 weeks

last release was 01/29/2023

last checked today at 5:00 PM

4937

The safe Markdown parser, reloaded.

Log in to subscribe

CVE History

CVE	Published	CVSS v2	CVSS v3
CVE-2020-26298	January 11, 2021	5.4 MEDIUM	3.5 LOW
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
CVE-2015-5147	July 14, 2015	N/A	7.5 HIGH
Stack-based buffer overflow in the header_anchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.