CVE-2026-2660

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2660
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2660.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2660
Published
2026-02-18T18:02:07.851Z
Modified
2026-07-08T08:06:58.093357518Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
FascinatedBox lily lily_symtab.c shorthash_for_name use after free
Details

A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthashforname of the file src/lily_symtab.c. The manipulation leads to use after free. Local access is required to approach this attack. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2660.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-416"
    ]
}
References

Affected packages

Git / github.com/fascinatedbox/lily

Affected ranges

Type
GIT
Repo
https://github.com/fascinatedbox/lily
Events
Introduced
d41b30dc93d296ab1d59363fec98ef2892a1c7fd
Last affected
6c1fb158e08c210b1f41dd5fc0417a0abf36ca55
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:lily-lang:lily:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.1"
        },
        {
            "last_affected": "2.1"
        },
        {
            "introduced": "2.2"
        },
        {
            "last_affected": "2.2"
        },
        {
            "introduced": "2.3"
        },
        {
            "last_affected": "2.3"
        },
        {
            "introduced": "0"
        }
    ]
}

Affected versions

2.*
2.0
2.1
2.2
2.3
v2.*
v2.0
v2.1
v2.2
v2.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2660.json"