CVE-2017-20166
Ecto missing `is_nil` requirement
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
- Record
CVE-2017-20166- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-754
- Updated
- 2026-11-02
CVE List
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
- Record
CVE-2017-20166- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-754
- Updated
- 2026-11-02
EUVDEUVD-2023-0331
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
- Record
EUVD-2023-0331- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2xxx-fhc8-9qvq
Ecto missing `is_nil` requirement
Ecto will not raise on queries with non-explicit nil comparisons (ie if they aren't checked with is_nil).
- Record
GHSA-2xxx-fhc8-9qvq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4r2f-6fm9-2qgh
Duplicate Advisory: Ecto lacks a protection mechanism
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2xxx-fhc8-9qvq. This link is maintained to preserve external references.
Original Description
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
- Record
GHSA-4r2f-6fm9-2qgh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
- Record
CVE-2017-20166- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-2xxx-fhc8-9qvq
Ecto missing `is_nil` requirement
Ecto will not raise on queries with non-explicit nil comparisons (ie if they aren't checked with is_nil).
- Record
GHSA-2xxx-fhc8-9qvq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-4r2f-6fm9-2qgh
Duplicate Advisory: Ecto lacks a protection mechanism
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2xxx-fhc8-9qvq. This link is maintained to preserve external references.
Original Description
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
- Record
GHSA-4r2f-6fm9-2qgh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, references | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-20166 is a critical vulnerability (CVSS 9.8) in Ecto Project Ecto, published April 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in ecto 2.2.1.