---
id: CVE-2024-21537
title: >-
  Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable
  to Arbitrary Code Execution due to the insecure usage of eval in the
  dynamicImport function
summary: >-
  Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable
  to Arbitrary Code Execution due to the insecure usage of eval in the
  dynamicImport function. An attacker can exploit this vulnerability by passing
  a malicious i…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
published: '2024-10-31'
updated: '2026-07-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-21537'
references:
  - url: >-
      https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7
    label: report@snyk.io
  - url: 'https://github.com/antonk52/lilconfig/pull/48'
    label: report@snyk.io
  - url: 'https://github.com/antonk52/lilconfig/releases/tag/v3.1.1'
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8323736'
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789'
    label: report@snyk.io
tags:
  - nvd
epss: 0.0113
epssPercentile: 0.64997
ingestedAt: '2026-07-29T16:48:32.183Z'
---

## Overview

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.