Vulnerability Intelligence Report
CVE-2020-17354
LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.
No Active Exploit Signals
CVSS Base Score
8.6
HIGH
Exploitability:1.9
Impact Score:6.1
EPSS Probability:0.41%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-863 ↗CWE-863 Incorrect Authorization
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| lilypond | lilypond | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.414%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2020-08-05T00:00:00 |
| Published | 2023-04-15T00:00:00 |
| Last Updated | 2025-02-06T17:00:20 |
Community Chatter & Buzz