José Valim

Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Cookie attribute injection in Plug.Conn.Cookies.encode/2

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff