CVE-2024-21537 lilconfig Code Injection vulnerability
An attacker can execute arbitrary code by passing malicious input to the defaultLoaders function in the lilconfig library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21537?
CVE-2024-21537 is a critical code injection vulnerability in lilconfig, published on 31 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.
Weakness: CWE-94
Which versions are affected by CVE-2024-21537?
2 open source packages ship an affected version, including lilconfig.
| Package | Affected | Fixed in |
|---|---|---|
lilconfig npm | From 3.1.0 | 3.1.1 |
lilconfig npm | From 3.1.0 | 3.1.1 |
How do I fix CVE-2024-21537?
Upgrade lilconfig to 3.1.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-21537 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21537 exists.
Sources
Also known as GHSA-fq9m-v26v-2m4f.