~ / search / GHSA-fq9m-v26v-2m4f

GHSA-fq9m-v26v-2m4f

lilconfig Code Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-21537

Packages

EcosystemPackageAffectedFixed in
npm lilconfig >= 3.1.0, < 3.1.1 3.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

References

External links from the advisory. They lead to third-party sites.