CVE-2024-21537

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-21537
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21537.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-21537
Aliases
Published
2024-10-31T05:00:03.948Z
Modified
2026-08-14T03:51:31.098679585Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
[none]
Details

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

Database specific 
{
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21537.json",
    "cna_assigner": "snyk"
}
References

Affected packages

Git / github.com/antonk52/lilconfig

Affected ranges

Type
GIT
Repo
https://github.com/antonk52/lilconfig
Events
Introduced
20f03087709f969ce33472898f25fed3a6f889fe
Fixed
0157290f6d133b3deacee4a686e073905e0f86ca
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "3.1.1"
        }
    ]
}

Affected versions

v3.*
v3.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21537.json"