Description
Loomio version 2.22.0 allows executing arbitrary commands on the server.
This is possible because the application is vulnerable to OS Command Injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Loomio | Loomio | 2.22.0 | — |
High · 7.2
CVE-2024-1297
EUVD-2024-17058GHSA-vx8g-76pm-2x2x
Loomio 2.22.0 - Code injection
Published Feb 19, 2024 · Updated Apr 20, 2026 · Assigned by Fluid Attacks