CVE-2020-17354 - CVE House
Back to Database
Status published Unknown CVE-2020-17354

LilyPond before 2.24 allows attackers to bypass the -dsafe protection...

Vulnerability Description

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-17354

Credits & Attribution

No credits recorded in the NVD database.

References

More from lilypond

View All →
CVE-2020-17353
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when...
Critical 9.8
CVE-2018-10992
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching...
Critical 9.8
CVE-2017-17523
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching...
High 8.8

Affected Vendor

Affected Software

lilypond
Vulnerable Versions:
0

Timeline

Official Publish: April 15th, 2023
Last Modified: February 6th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.