CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.

• CWE-94

• https://github.com/CycloneDX/cdxgen/issues/1328
• https://github.com/CycloneDX/cdxgen/releases
• https://owasp.org/www-project-dep-scan/

Published

Oct 27, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50602An issue was discovered in libexpat before 2.6.4. There is a…5.9
• CVE-2024-50603An issue was discovered in Aviatrix Controller before 7.1.41…9.8
• CVE-2024-50608An issue was discovered in Fluent Bit 3.1.9. When the Promet…7.5
• CVE-2024-50609An issue was discovered in Fluent Bit 3.1.9. When the OpenTe…7.5
• CVE-2024-5061The Enfold - Responsive Multi-Purpose Theme theme for WordPr…5.4
• CVE-2024-50610GSL (GNU Scientific Library) through 2.8 has an integer sign…3.6
• CVE-2024-50612libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis…5.5
• CVE-2024-50613libsndfile through 1.2.2 has a reachable assertion, that may…6.5
• CVE-2024-50614TinyXML2 through 10.0.0 has a reachable assertion for UINT_M…6.5
• CVE-2024-50615TinyXML2 through 10.0.0 has a reachable assertion for UINT_M…6.5
• CVE-2024-50616Ironman PowerShell Universal 5.x before 5.0.12 allows an aut…8.8
• CVE-2024-50617Vulnerabilities in the File Download and Get File handler co…7.5