CVE-2024-30254

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files if the attacker can make the victim either run the language server within a specific crafted project or `mesonlsp --full`. Version 4.1.4 contains a patch for this issue. As a workaround, avoid running `mesonlsp --full` and set the language server option `others.neverDownloadAutomatically` to `true`.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-302557.5Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, anCVE-2024-302566.4Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerabilitCVE-2024-302575.91Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != sCVE-2024-302587.5FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14CVE-2024-302597.5FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14CVE-2024-30265.4The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users wCVE-2024-302604.3Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, CVE-2024-302613.5Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `CVE-2024-302627.1Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal CVE-2024-302637.7macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using theCVE-2024-302649.3Typebot is an open-source chatbot builder. A reflected cross-site scripting (XSS) in the sign-in page of typebot.io prior to version 2.24.0 CVE-2024-302657.5Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file