What’s Vulnerable › Vulnerabilities

CVE-2020-11082: Cross-Site Scripting in Kaminari

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-28 · updated 2026-06-17
• Weakness: CWE-79

Description

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Affected products

• Debian Linux: 9.0, 10.0
• Kaminari Project Kaminari: before 1.2.1 — fixed in 1.2.1
• Rubygems Kaminari: before 1.2.1; 0.1.0, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4 (+45) — fixed in 1.2.1

How to fix

Upgrade to a fixed version: Kaminari Project Kaminari 1.2.1; Rubygems Kaminari 1.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/github/advisory-review/pull/1020
• https://github.com/kaminari/kaminari/commit/8dd52a1aed3d2fa2835d836de23fc0d8c4ff5db8
• https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433
• https://lists.debian.org/debian-lts-announce/2021/09/msg00011.html
• https://www.debian.org/security/2021/dsa-5005
• https://github.com/github/advisory-review/pull/1020
• https://github.com/kaminari/kaminari/commit/8dd52a1aed3d2fa2835d836de23fc0d8c4ff5db8
• https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433
• https://lists.debian.org/debian-lts-announce/2021/09/msg00011.html
• https://www.debian.org/security/2021/dsa-5005

Get alerted when CVE-2020-11082 or the next vulnerability affects your stack