Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacke

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
snyk

Description

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a lilconfig

  • 3.1.0 to < 3.1.1affected

n/a org.webjars.npm:lilconfig

  • 3.1.0 to < 3.1.1affected

References