GitHub Advisoryadvisory · Hex

GHSA-w98m-2xqg-9cvj Remote Code Execution in paginator

CRITICAL Published 2022-04-12 Modified 2022-04-12 Official page ↗
Aliases
CVE-2020-15150
Ecosystem
Hex
Packages
paginator
Severity
Critical
Reviewed
2022-04-12

Affected packages

• Hex paginator: < 1.0.0 → fixed in 1.0.0

Description

There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. Impact There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This will potentially affect all current users of `Paginator` prior to version >= 1.0.0. Patches The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5. Credits Thank you to Peter Stöckli.

Related

Alias · CVE (1)

  • CVE-2020-15150 There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input… vulnerability

References