GitHub Advisoryadvisory · Hex

GHSA-6x65-vqp7-5r63 alchemist.vim vulnerable to remote code execution

CRITICAL Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-1000212
Ecosystem
Hex
Packages
alchemist.vim
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed
2022-07-01

Affected packages

• Hex alchemist.vim: < 1.3.2 → fixed in 1.3.2

Description

Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.

Related

Alias · CVE (1)

  • CVE-2017-1000212 Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. vulnerability

References