CVE-2024-21537CWE-94

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport…

Critical · published October 31, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.01130 · 66.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-10-31T05:00Z
EPSS history
Timeline
  • 31 OCT 05:00Z
    Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport…
    cvelistv5