CVE-2020-17354

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.

• CWE-863
• CWE-863

• http://lilypond.org/doc/v2.18/Documentation/usage/command_002dline-usageRelease Notes
• https://gitlab.com/lilypond/lilypond/-/merge_requests/1522Patch, Vendor Advisory
• https://lilypond.org/download.htmlProduct
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K43PF6VGFJNNGAPY57BW3VMEFFOSMRLF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST5BLLQ4GDME3SN7UE5OMNE5GZE66X4Y/
• https://phabricator.wikimedia.org/T259210Exploit, Third Party Advisory
• https://tracker.debian.org/news/1249694/accepted-lilypond-2221-1-source-into-unstable/Mailing List, Release Notes, Third Party Advisory
• https://www.mediawiki.org/wiki/Extension:Score/2021_security_advisoryThird Party Advisory
• http://lilypond.org/doc/v2.18/Documentation/usage/command_002dline-usageRelease Notes
• https://gitlab.com/lilypond/lilypond/-/merge_requests/1522Patch, Vendor Advisory
• https://lilypond.org/download.htmlProduct
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K43PF6VGFJNNGAPY57BW3VMEFFOSMRLF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST5BLLQ4GDME3SN7UE5OMNE5GZE66X4Y/
• https://phabricator.wikimedia.org/T259210Exploit, Third Party Advisory
• https://tracker.debian.org/news/1249694/accepted-lilypond-2221-1-source-into-unstable/Mailing List, Release Notes, Third Party Advisory
• https://www.mediawiki.org/wiki/Extension:Score/2021_security_advisoryThird Party Advisory

Published

Apr 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1732A flaw was found in Soteria before 1.0.1, in a way that mult…4.2
• CVE-2020-1733A race condition flaw was found in Ansible Engine 2.7.17 and…5
• CVE-2020-1734A flaw was found in the pipe lookup plugin of ansible. Arbit…7.4
• CVE-2020-1735A flaw was found in the Ansible Engine when the fetch module…4.6
• CVE-2020-17352Two OS command injection vulnerabilities in the User Portal …8.8
• CVE-2020-17353scm/define-stencil-commands.scm in LilyPond through 2.20.0, …9.8
• CVE-2020-17355Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x be…7.5
• CVE-2020-1736A flaw was found in Ansible Engine when a file is moved usin…3.3
• CVE-2020-17360An issue was discovered in ReadyTalk Avian 1.2.0. The vm::ar…7.8
• CVE-2020-17361An issue was discovered in ReadyTalk Avian 1.2.0. The vm::ar…5.5
• CVE-2020-17362search.php in the Nova Lite theme before 1.3.9 for WordPress…6.1
• CVE-2020-17363USVN (aka User-friendly SVN) before 1.0.9 allows remote code…9.9