CVE-2022-24803: Asciidoctor-Include-Ext Project Asciidoctor-Include-Ext

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.

Affected products

• Asciidoctor-Include-Ext Project Asciidoctor-Include-Ext: before 0.4.0 (fixed in 0.4.0)

Published 2022-04-01. Last modified 2026-06-17.