CVE-2024-21537

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-31 · updated 2026-07-29
Weakness: CWE-94

Description

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

Affected products

Antonk52 Lilconfig: from 3.1.0 before 3.1.1 — fixed in 3.1.1

How to fix

Upgrade to a fixed version: Antonk52 Lilconfig 3.1.1. Check the vendor advisory for mitigations.

References

https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7
https://github.com/antonk52/lilconfig/pull/48
https://github.com/antonk52/lilconfig/releases/tag/v3.1.1
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8323736
https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789

Get alerted when CVE-2024-21537 or the next vulnerability affects your stack