~ / search / GHSA-w98m-2xqg-9cvj

GHSA-w98m-2xqg-9cvj

Remote Code Execution in paginator

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-15150

Packages

EcosystemPackageAffectedFixed in
Hex paginator < 1.0.0 1.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. ### Impact There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This will potentially affect all current users of `Paginator` prior to version >= 1.0.0. ### Patches The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5. ### Credits Thank you to Peter Stöckli.

References

External links from the advisory. They lead to third-party sites.