Which versions of lilconfig are affected by CVE-2024-21537?

lilconfig versions prior to 3.1.1 contain an arbitrary code execution vulnerability (CVSS 8.9) with publicly available exploit code.. A patch is available.

How to fix or mitigate CVE-2024-21537?

Within 24 hours, conduct a complete inventory of all applications and dependencies using lilconfig, focusing on identifying any running version 3.1.0 or earlier. Within 7 days, upgrade all affected instances to lilconfig 3.1.1 or later through your standard change management process, prioritizing production systems and testing thoroughly in staging environments before deployment. Within 30 days, complete deployment across all production, staging, and development environments, document the remediation in your asset management system, and confirm that no version 3.1.0 instances remain.

lilconfig CVE-2024-21537

Q: What is the CVSS score of CVE-2024-21537?

CVE-2024-21537 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

HIGH

Code Injection (CWE-94)

2024-10-31 report@snyk.io

RCE Code Injection

8.9

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Full RCE impact justifies C/I/A:H, but reaching the eval sink requires attacker-controlled input to flow into the loader (a non-default app pattern), so AC:H rather than the vendor's AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 29, 2026 - 16:30 vuln.today

Analysis Updated

Jul 29, 2026 - 16:30 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 29, 2026 - 16:22 NVD

8.8 (HIGH) 8.9 (HIGH)

CVE Published

Oct 31, 2024 - 05:15 cve.org

HIGH 8.8

DescriptionCVE.org

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

AnalysisAI

Arbitrary code execution in the lilconfig npm configuration loader (version 3.1.0, fixed in 3.1.1) lets an attacker who controls input reaching the defaultLoaders function run arbitrary JavaScript, because the dynamicImport helper resolves modules through an insecure eval call (CWE-94). The flaw was reported by Snyk and carries a CVSS 4.0 base score of 8.9; publicly available exploit code exists (E:P in the vector), but there is no public exploit identified in CISA KEV and EPSS is a modest 1.06% (61st percentile), indicating exploitation hinges on how the host application feeds data into the loader rather than broad opportunistic attacks.

Technical ContextAI

lilconfig is a lightweight, dependency-free JavaScript configuration file loader for Node.js, functionally similar to cosmiconfig and widely pulled in transitively by tooling that reads project config (PostCSS, stylelint and related ecosystems). The vulnerability is a CWE-94 code injection: the internal dynamicImport function builds and executes code via eval to perform a dynamic import of a module identifier, so if the identifier or path passed through defaultLoaders is attacker-influenced, that string is evaluated as JavaScript rather than safely imported. The exact affected package is npm 'lilconfig' 3.1.0 (also surfaced as the WebJars/Maven mirror org.webjars.npm:lilconfig per the second Snyk reference); no CPE strings were supplied in the input, so identification rests on the package coordinates in the description and references.

Affected ProductsAI

The affected component is the npm package lilconfig at version 3.1.0 (the description states 'from 3.1.0 and before 3.1.1', i.e. only 3.1.0 is vulnerable and 3.1.1 is fixed); the same defect is mirrored in the WebJars/Maven distribution org.webjars.npm:lilconfig. No CPE identifiers were provided in the source data. Vendor and advisory detail is available via the upstream release notes at https://github.com/antonk52/lilconfig/releases/tag/v3.1.1 and the Snyk advisories at https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789 and https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8323736.

RemediationAI

Vendor-released patch: upgrade lilconfig to 3.1.1 or later, which removes the insecure eval-based dynamic import (see release https://github.com/antonk52/lilconfig/releases/tag/v3.1.1, fix PR https://github.com/antonk52/lilconfig/pull/48, and commit https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7). Because lilconfig is frequently a transitive dependency, run npm/yarn/pnpm audit and use lockfile overrides (npm 'overrides' or yarn 'resolutions') to force 3.1.1 across nested dependents, then rebuild. If you cannot upgrade immediately, the concrete compensating control is to ensure no attacker-controlled value ever reaches lilconfig's loader input: pass only trusted, application-defined config file paths to lilconfig/lilconfigSync and defaultLoaders, and refuse to derive the searched module id from user input, request parameters, or uploaded content - the trade-off is that you must audit and possibly refactor any dynamic-config feature that lets users specify config locations. Consult the Snyk advisory at https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789 for tracking.