What’s Vulnerable › Vulnerabilities

CVE-2024-50611

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-27 · updated 2026-06-17
• Weakness: CWE-94

Description

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.

Affected products

• CycloneDX Cdxgen: through 10.10.7

References

• https://github.com/CycloneDX/cdxgen/issues/1328
• https://github.com/CycloneDX/cdxgen/releases
• https://owasp.org/www-project-dep-scan/

Get alerted when CVE-2024-50611 or the next vulnerability affects your stack