Remote Code Execution Vulnerability in Ashlar-Vellum Lithium

CVE-2023-44440

Summary

The Ashlar-Vellum Lithium software is susceptible to a vulnerability that allows remote code execution via an uncontrolled search path element. This flaw is triggered when the application parses various file types and attempts to load a library from an unsecured location. For successful exploitation, user interaction is necessary, as the user must either access a malicious webpage or open a compromised file. By leveraging this vulnerability, an attacker can execute arbitrary code within the context of the current application process, potentially gaining control over the system running Ashlar-Vellum Lithium.

References