CVE-2024-50611
CVE-2024-50611
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.
CVSS 7.2 · High · EPSS 0.8% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
@cyclonedx/cdxgen npm
- Affected ranges
- SEMVER: < 11.1.7
Update to 11.1.7