Elixir 1.20

Apply the Erlang/OTP 29 prompt first. These rules cover Elixir 1.20.

Data conversion and code execution

• Never create atoms from untrusted text with String.to_atom/1; use a fixed mapping or String.to_existing_atom/1 with explicit failure handling.
• Treat Code.eval_string/3, Code.eval_quoted/3, Code.compile_string/2, Code.require_file/2, EEx.eval_string/3, and runtime module loading as code execution, not parsing.
• Use Code.string_to_quoted/2 with existing_atoms_only: true and bounded untrusted input; do not use an atom-creating :static_atoms_encoder or evaluate untrusted AST.
• Do not pass attacker-controlled module, function, protocol, or exception names to apply/3 without an allowlist.
• Reject untrusted version or requirement text over a small application limit, such as 64 bytes, before calling Version.parse/1, parse!/1, parse_requirement/1, match?/3, or compare/2. On Elixir 1.20.0, which predates the 1.20.1 fix for CVE-2026-49762, that limit is the only bound on how long a numeric component can be.
• On Elixir 1.20 releases before 1.20.4, which predate the CVE-2026-75758 fix, install the official application-start workaround with Inspect.Opts.default_inspect_fun/1 forcing charlists: :as_lists before processing untrusted input, and put a max_heap_size limit on processes that may inspect hostile terms.

Processes, tasks, and state

• Validate and authorize messages in GenServer.handle_call/3, handle_cast/2, and handle_info/2 before changing state.
• Supervise long-lived tasks and use Task.Supervisor.async_nolink/3