GitHub Advisoryadvisory · npm

GHSA-fq9m-v26v-2m4f lilconfig Code Injection vulnerability

HIGH Published 2024-10-31 Modified 2024-11-01 Official page ↗
Aliases
CVE-2024-21537
Ecosystem
npm
Packages
lilconfig
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-11-01

Affected packages

• npm lilconfig: >= 3.1.0, < 3.1.1 → fixed in 3.1.1

Description

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

Related

Alias · CVE (1)

  • CVE-2024-21537 Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References