CVE-2024-21537: lilconfig Package RCE Vulnerability

CVE-2024-21537 Overview

CVE-2024-21537 affects the lilconfig npm package, a lightweight configuration loader used by many JavaScript build tools and libraries. Versions from 3.1.0 and before 3.1.1 contain an arbitrary code execution vulnerability caused by insecure use of eval inside the dynamicImport function. Attackers can trigger execution by passing malicious input through the defaultLoaders function. The issue is categorized under CWE-94: Improper Control of Generation of Code.

Critical Impact
An attacker who controls input reaching lilconfig's dynamic import path can execute arbitrary JavaScript in the process context, compromising confidentiality, integrity, and availability of the host application.

Affected Products

lilconfig npm package versions >=3.1.0 <3.1.1
Downstream Java WebJar repackage org.webjars.npm:lilconfig (tracked as SNYK-JAVA-ORGWEBJARSNPM-8323736)
Node.js applications and toolchains that transitively depend on the vulnerable lilconfig release

Discovery Timeline

2024-10-31 - CVE-2024-21537 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2024-21537

Vulnerability Analysis

lilconfig searches for and loads configuration files from a project directory. In 3.1.0, the dynamicImport helper used by defaultLoaders invokes eval to import ES module configuration files at runtime. When configuration file paths or contents are influenced by untrusted input, the eval call executes attacker-controlled JavaScript inside the Node.js process.

Exploitation does not require authentication and can be triggered remotely when a vulnerable service loads configuration derived from user-controlled sources. The impact is arbitrary code execution with the privileges of the Node.js process, which typically grants filesystem, network, and secrets access.

Root Cause

The root cause is the use of eval as a workaround for dynamic import() in CommonJS builds. Because the value passed to eval was not restricted to a safe, sanitized import specifier, any injected JavaScript expression executed with full runtime privileges. This maps directly to CWE-94 — improper control of code generation.

Attack Vector

An attacker supplies a crafted path or configuration file that reaches defaultLoaders, which then hands it to dynamicImport. The eval-based loader evaluates the payload instead of performing a safe module import. In build pipelines, plugin systems, or SaaS services that accept user-provided configuration, this yields remote code execution.

javascript

// Security patch in src/index.js (v3.1.1)
// Source: https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39ab07a9b0a7
     return path.dirname(p) || path.sep;
 }
 
-/** @type {import('./index.d.ts').LoaderSync} */
+/** @type {import('./index').LoaderSync} */
 const jsonLoader = (_, content) => JSON.parse(content);
-/** @type {import('./index.d.ts').LoadersSync} */
+/** @type {import('./index').LoadersSync} */
 const defaultLoadersSync = Object.freeze({
     '.js': require,
     '.json': require,

The patch, along with additional changes in pull request #48, removes the unsafe eval-based dynamic import path used by the default loaders.

Detection Methods for CVE-2024-21537

Indicators of Compromise

Presence of lilconfig@3.1.0 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Node.js processes spawning unexpected child processes (sh, bash, curl, wget) from build or configuration-load stages
Outbound network connections from build agents to unrecognized hosts during dependency resolution

Detection Strategies

Run Software Composition Analysis (SCA) or npm audit to flag any resolved version of lilconfig between 3.1.0 (inclusive) and 3.1.1 (exclusive)
Search source trees for transitive dependencies via npm ls lilconfig and pnpm why lilconfig
Alert on runtime use of eval and Function constructors inside Node.js services handling untrusted configuration input

Monitoring Recommendations

Monitor CI/CD build agents for anomalous process trees originating from node executing configuration loaders
Track file writes to sensitive paths and credential stores during dependency installation and application startup
Ingest package registry telemetry into your SIEM to correlate dependency changes with subsequent runtime anomalies

How to Mitigate CVE-2024-21537

Immediate Actions Required

Upgrade lilconfig to version 3.1.1 or later in all direct and transitive dependencies
Regenerate lockfiles and rebuild container images to ensure the fixed version is deployed
Audit services that accept user-supplied configuration paths or content for exposure to lilconfig loaders

Patch Information

The fix is available in lilconfig v3.1.1 via commit 2c68a1a and pull request #48. Additional advisory details are available from Snyk SNYK-JS-LILCONFIG-6263789 and Snyk SNYK-JAVA-ORGWEBJARSNPM-8323736.

Workarounds

Pin lilconfig to a safe version using overrides (npm/pnpm) or resolutions (Yarn) if a transitive dependency blocks direct upgrade
Restrict the set of file extensions and paths passed to defaultLoaders so that untrusted input cannot reach the dynamic import routine
Isolate build and configuration-loading workloads in ephemeral, least-privileged containers to limit blast radius

bash

# Upgrade lilconfig across the dependency tree
npm install lilconfig@^3.1.1

# Force resolution of a transitive dependency (package.json)
# npm >= 8.3 / pnpm
#   "overrides": { "lilconfig": "^3.1.1" }
# Yarn
#   "resolutions": { "lilconfig": "^3.1.1" }

# Verify no vulnerable version remains
npm ls lilconfig
npm audit --production