{
  "schema_version": "1.4.0",
  "id": "GHSA-w98m-2xqg-9cvj",
  "modified": "2022-04-12T19:36:39Z",
  "published": "2022-04-12T19:36:39Z",
  "aliases": [
    "CVE-2020-15150"
  ],
  "summary": "Remote Code Execution in paginator",
  "details": "There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function.\n\n### Impact\nThere is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This will potentially affect all current users of `Paginator` prior to version >= 1.0.0.\n\n### Patches\nThe vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.\n\n### Credits\n\nThank you to Peter Stöckli.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "paginator"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15150"
    },
    {
      "type": "WEB",
      "url": "https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/duffelhq/paginator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations"
    },
    {
      "type": "WEB",
      "url": "https://hex.pm/packages/paginator"
    }
  ],
  "database_specific": {
    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-12T19:36:39Z",
    "nvd_published_at": "2020-09-01T17:15:00Z"
  }
}