Arbitrary Code Execution Vulnerability in Lilconfig Versions 3.1.0-3.1.1

Summary

Versions of the lilconfig package, specifically those from 3.1.0 and earlier than 3.1.1, are susceptible to arbitrary code execution. This vulnerability arises from improper usage of the eval function within the dynamicImport functionality. Attackers can exploit this flaw by sending specially crafted malicious input through the defaultLoaders function, potentially leading to unauthorized execution of code within the affected applications. Developers using lilconfig are urged to upgrade to version 3.1.1 or later to mitigate this risk.

References