It was discovered that kramdown did not restrict Rouge formatters to the
correct namespace. An attacker could use this issue to cause kramdown to
execute arbitrary code.

Read More