scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lilypond | Lilypond | * | 2.20.0 (including) |
| Lilypond | Lilypond | 2.21.0 (including) | 2.21.4 (including) |
| Lilypond | Ubuntu | bionic | * |
| Lilypond | Ubuntu | esm-apps/bionic | * |
| Lilypond | Ubuntu | esm-apps/focal | * |
| Lilypond | Ubuntu | esm-apps/xenial | * |
| Lilypond | Ubuntu | focal | * |
| Lilypond | Ubuntu | groovy | * |
| Lilypond | Ubuntu | trusty | * |
| Lilypond | Ubuntu | upstream | * |
| Lilypond | Ubuntu | xenial | * |