CVE-2020-17354: lilypond Incorrect Authorization
Vulnerability summary
CVE-2020-17354 is a high (CVSS 8.6) Incorrect Authorization vulnerability in lilypond. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 15-04-2023PublishedVulnerability first disclosed.
- 06-02-2025Last modifiedVulnerability information updated.
Description
LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- NVDNIST8.6HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (phabricator.wikimedia.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- lilypond< 2.22.1-1
Lilypond1 product
- lilypond< 2.24.0
Mageia1 product
- lilypond< 2.24.2-2.mga9
Ubuntu1 product
- lilypondAll versions (No fix recorded)
4 vendors · 4 products
References
14 links
tracker.debian.org/news/1249694/accepted-lilypond-2221-1-source-into-unstable/Mailing ListRelease NotesThird Party Advisory- lilypond.org/download.htmlProduct
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory