CVE-2024-30254

MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files if the attacker can make the victim either run the language server within a specific crafted project or `mesonlsp --full`. Version 4.1.4 contains a patch for this issue. As a workaround, avoid running `mesonlsp --full` and set the language server option `others.neverDownloadAutomatically` to `true`.

• CWE-22

• https://github.com/JCWasmx86/mesonlsp/commit/594b6334061371911cd59389124ab8af30ce0a3a
• https://github.com/JCWasmx86/mesonlsp/security/advisories/GHSA-48c5-35fh-846h
• https://github.com/JCWasmx86/mesonlsp/commit/594b6334061371911cd59389124ab8af30ce0a3a
• https://github.com/JCWasmx86/mesonlsp/security/advisories/GHSA-48c5-35fh-846h

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30249Cloudburst Network provides network components used within C…8.6
• CVE-2024-3025mintplex-labs/anything-llm is vulnerable to path traversal a…9.9
• CVE-2024-30250Astro-Shield is an integration to enhance website security w…7.5
• CVE-2024-30251aiohttp is an asynchronous HTTP client/server framework for …7.5
• CVE-2024-30252Livemarks is a browser extension that provides RSS feed book…2.6
• CVE-2024-30253@solana/web3.js is the Solana JavaScript SDK. Using particul…7.5
• CVE-2024-30255Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-30256Open WebUI is a user-friendly WebUI for LLMs. Open-webui is …6.4
• CVE-2024-302571Panel is an open source Linux server operation and maintena…5.9
• CVE-2024-30258FastDDS is a C++ implementation of the DDS (Data Distributio…7.5
• CVE-2024-30259FastDDS is a C++ implementation of the DDS (Data Distributio…7.5
• CVE-2024-3026The WordPress Button Plugin MaxButtons WordPress plugin befo…5.4