Description
A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthash_for_name of the file src/lily_symtab.c. The manipulation leads to use after free. Local access is required to approach this attack. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-02-18
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use After Free
Action: Assess Impact
AI Analysis

Impact

This vulnerability resides in the shorthash_for_name function of lily's symbol table module. A fault in memory handling results in a use‑after‑free condition when a maliciously crafted name is processed. The flaw may cause arbitrary read or write of memory, potentially enabling execution of code with the privileges of the running process. The associated weaknesses are CWE‑119 and CWE‑416.

Affected Systems

Vendors: FascinatedBox. Product: lily. Affected versions: up to 2.3.

Risk and Exploitability

The CVSS base score is 4.8, indicating moderate severity. EPSS is less than 1 %, showing a low probability of exploitation, yet a public exploit is available. The attack requires local access to the lily interpreter, so the risk is confined to machines where a local attacker can run the vulnerable code. There is no KEV listing.

Generated by OpenCVE AI on April 17, 2026 at 18:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest official lily release when it becomes available, ensuring the use‑after‑free fix is included.
  • If a patch is not yet released, restrict local access to lily processes and run them with the least privilege necessary. Verify that only trusted users can execute lily code.
  • Enable system‑wide Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on hosts running lily to mitigate exploitation of memory corruption.

Generated by OpenCVE AI on April 17, 2026 at 18:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Feb 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Lily-lang
Lily-lang lily
CPEs cpe:2.3:a:lily-lang:lily:*:*:*:*:*:*:*:*
Vendors & Products Lily-lang
Lily-lang lily

Thu, 19 Feb 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Fascinatedbox
Fascinatedbox lily
Vendors & Products Fascinatedbox
Fascinatedbox lily

Wed, 18 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 18 Feb 2026 18:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthash_for_name of the file src/lily_symtab.c. The manipulation leads to use after free. Local access is required to approach this attack. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title FascinatedBox lily lily_symtab.c shorthash_for_name use after free
Weaknesses CWE-119
CWE-416
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Fascinatedbox Lily
Lily-lang Lily
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T10:18:47.628Z

Reserved: 2026-02-18T07:25:33.125Z

Link: CVE-2026-2660

cve-icon Vulnrichment

Updated: 2026-02-18T18:45:38.838Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-18T19:21:44.293

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2660

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T18:45:25Z

Weaknesses