by Kastro
Paper/Archive/CVE-2024-21537

CVE-2024-21537

antonk52 lilconfig — Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eva…

EPSS 1%public exploitCVSS 9.3
critical.is priorityof 100
51
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 66.4.664 × 2013.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

Affected

ProductAffectedFixed inSource
lilconfig3.1.0 – < 3.1.13.1.1CNA
org.webjars.npm:lilconfig3.1.0 – < 3.1.13.1.1CNA
lilconfig3.1.0 – < 3.1.13.1.1CISA-ADP

Scores by source

snyk (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
snyk (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789refsecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8323736refgithub.com/antonk52/lilconfig/pull/48refgithub.com/antonk52/lilconfig/releases/tag/v3.1.1refgithub.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7