Description
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | plug | < 1.0.4 | 1.0.4 | GHSA-5v4m-c73v-c7gq |
| Hex | plug | >= 1.1.0, < 1.1.7 | 1.1.7 | GHSA-5v4m-c73v-c7gq |
| Hex | plug | >= 1.2.0, < 1.2.3 | 1.2.3 | GHSA-5v4m-c73v-c7gq |
| Hex | plug | >= 1.3.0, < 1.3.2 | 1.3.2 | GHSA-5v4m-c73v-c7gq |