{"id":"CVE-2020-11082","aliases":["GHSA-r5jw-62xg-j433"],"url":"https://o3.security/vulnerability/CVE-2020-11082","summary":"Cross-Site Scripting in Kaminari","details":"### Impact\nIn Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.\n\n### Releases\nThe 1.2.1 gem including the patch has already been released.\nAll past released versions are affected by this vulnerability.\n\n### Workarounds\nApplication developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.\n\n```ruby\nmodule Kaminari::Helpers\n  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze\nend\n```\n\n### Credits\nThanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.","published":"2020-05-28T21:15:11.437Z","modified":"2026-07-08T06:00:17.843311539Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"kaminari","fixedVersion":"1.2.1"}],"fix":{"url":"https://github.com/github/advisory-review/pull/1020","label":"github/advisory-review#1020"},"references":[{"type":"ADVISORY","url":"https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00011.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-5005"},{"type":"FIX","url":"https://github.com/github/advisory-review/pull/1020"},{"type":"FIX","url":"https://github.com/kaminari/kaminari/commit/8dd52a1aed3d2fa2835d836de23fc0d8c4ff5db8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11082"},{"type":"PACKAGE","url":"https://github.com/kaminari/kaminari"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kaminari/CVE-2020-11082.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:00:17.843311539Z"}}