CVE-2024-1297

7.2 highEPSS 2.7%

High (7.2) in loomio loomio. EPSS 2.7% chance of exploitation in the next 30 days.

Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2024-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

loomio:loomio

References

https://fluidattacks.com/advisories/stones
https://github.com/loomio/loomio
https://github.com/loomio/loomio/commit/6bc5429bfb5a9c7c811a4487d97ea54a8b23a0fa#diff-b9a7e6b3dfb0fd855c11198a7c53e6f6f90945f28c78cc5dbd960d04d5d28203
https://fluidattacks.com/advisories/stones
https://github.com/loomio/loomio

Check your stack JSON