CVE-2024-3094

CVE-2024-3094 is a critical supply chain vulnerability affecting xz versions 5.6.0 and 5.6.1, where malicious code was embedded into the liblzma library. This sophisticated backdoor, disguised within test files, modifies specific functions to intercept and alter data interactions. With a CVSS score of 10.0 and an EPSS score indicating extremely high exploitability, this vulnerability allows unauthenticated remote attackers to achieve full system compromise (confidentiality, integrity, and availability). While not yet listed in CISA's KEV catalog, its high FAUCET Risk Score of 100/100, numerous community discussions, and extensive media coverage highlight its severe threat and widespread concern. Although no Metasploit or ExploitDB modules exist, Nuclei templates are available, and public repositories demonstrate reproduction of the exploit.