PT-2024-23301 · Mesonlsp · Mesonlsp

Jcwasmx86 · Published 2024-04-04 · Updated 2024-04-04 · CVE-2024-30254

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions MesonLSP versions prior to 4.1.4

Description A vulnerability in MesonLSP allows overwriting arbitrary files if an attacker can make the victim run the language server within a specific crafted project or execute mesonlsp --full.

Recommendations For versions prior to 4.1.4, update to version 4.1.4 to resolve the issue. As a temporary workaround, avoid running mesonlsp --full and set the language server option others.neverDownloadAutomatically to true.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-30254

GHSA-48C5-35FH-846H

Affected Products

Mesonlsp

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30254.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-30254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30254 · Security Note
• https://github.com/JCWasmx86/mesonlsp/commit/594b6334061371911cd59389124ab8af30ce0a3a · Note
• https://github.com/JCWasmx86/mesonlsp/security/advisories/GHSA-48c5-35fh-846h · Note