{"id":"CVE-2020-15150","aliases":["GHSA-w98m-2xqg-9cvj"],"url":"https://o3.security/vulnerability/CVE-2020-15150","summary":"Remote Code Execution in paginator","details":"There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function.\n\n### Impact\nThere is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This will potentially affect all current users of `Paginator` prior to version >= 1.0.0.\n\n### Patches\nThe vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.\n\n### Credits\n\nThank you to Peter Stöckli.","published":"2020-09-01T17:15:11.840Z","modified":"2026-10-20T10:52:47.965727590Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Hex","name":"paginator","fixedVersion":"1.0.0"}],"fix":{"url":"https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8","label":"duffelhq/paginator@bf45e92"},"references":[{"type":"WEB","url":"https://hex.pm/packages/paginator"},{"type":"ADVISORY","url":"https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations"},{"type":"ADVISORY","url":"https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj"},{"type":"FIX","url":"https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15150"},{"type":"PACKAGE","url":"https://github.com/duffelhq/paginator"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:52:47.965727590Z"}}