Executive brief
lilconfig is a lightweight configuration file loader used in JavaScript projects. A code injection vulnerability in versions 3.1.0 and earlier allows attackers with the ability to control configuration inputs to execute arbitrary code, potentially compromising the application and any data it processes.
Technical details
The vulnerability is a CWE-94 code injection flaw in the dynamicImport function of lilconfig, which insecurely uses eval() to handle dynamic imports. An attacker can exploit this by passing malicious input through the defaultLoaders function. While the reported severity is low (3.1 CVSS v3.1), the OSV database lists this as HIGH severity (8.8 CVSS v3.1) with network reachability and low privilege requirements. The vulnerability affects versions 3.1.0 through 3.1.0; it is fixed in version 3.1.1. The flaw was introduced due to TypeScript compilation constraints that forced the use of eval for dynamic imports when targeting CommonJS.
Affected products
- antonk52 lilconfig 3.1.0 through 3.1.0
Timeline
- 2024-10-31: disclosed: GHSA-fq9m-v26v-2m4f published
- 2024: patched: Fixed in version 3.1.1