Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02eDY1LXZxcDctNXI2M84AAR2T

alchemist.vim vulnerable to remote code execution

Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.

Permalink: https://github.com/advisories/GHSA-6x65-vqp7-5r63
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02eDY1LXZxcDctNXI2M84AAR2T
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-6x65-vqp7-5r63, CVE-2017-1000212
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000212
• https://github.com/tonini/alchemist-server/issues/14
• https://github.com/tonini/alchemist-server/pull/16
• https://elixirforum.com/t/static-and-session-security-fixes-for-plug/3913
• https://github.com/advisories/GHSA-6x65-vqp7-5r63

Repository: https://github.com/tonini/alchemist-server
Blast Radius: 1.0

Affected Packages