CVE-2024-21537
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 31, 2024
- Updated
- Aug 17, 2026
- Reserved
- Dec 22, 2023
Description
Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | snyk |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P | snyk |
Weaknesses
- CWE-94 Arbitrary Code Execution
Affected Products
| Product | Versions |
|---|---|
lilconfign/a |
|
org.webjars.npm:lilconfign/a |
|
References
- https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8323736
- https://github.com/antonk52/lilconfig/pull/48
- https://github.com/antonk52/lilconfig/releases/tag/v3.1.1
- https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.