What’s Vulnerable › Vulnerabilities

CVE-2024-1297: Loomio 2.22.0 - Code injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-20 · updated 2026-06-17
• Weakness: CWE-78

Description

Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection.

Affected products

• Loomio: 2.22.0

References

• https://fluidattacks.com/advisories/stones
• https://github.com/loomio/loomio
• https://github.com/loomio/loomio/commit/6bc5429bfb5a9c7c811a4487d97ea54a8b23a0fa#diff-b9a7e6b3dfb0fd855c11198a7c53e6f6f90945f28c78cc5dbd960d04d5d28203
• https://fluidattacks.com/advisories/stones
• https://github.com/loomio/loomio

Get alerted when CVE-2024-1297 or the next vulnerability affects your stack