CVE-2020-17354: 
NixOS vulnerability analysis and mitigation

LilyPond before version 2.24 contained a vulnerability that allowed attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope functions. The vulnerability enabled arbitrary code execution during file format conversion through dangerous Scheme code in .ly files. Notably, in version 2.24 and later, safe mode was completely removed as the product no longer attempts to block code execution when external files are used (NVD, Debian Tracker).

The vulnerability exploited two main functions in LilyPond's implementation: output-def-lookup and output-def-scope. These functions provided access to a module object created by the parser outside the sandbox, inheriting all top-level bindings and giving access to all Scheme functions outside the sandbox. The vulnerability received a CVSS v3.1 Base Score of 8.6 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (NVD, Phabricator).

The vulnerability allowed attackers to execute arbitrary code on the system by bypassing LilyPond's safe mode protections. This was particularly concerning for web servers that provided LilyPond formatting capabilities, as it could lead to remote code execution. The impact was severe enough that Wikimedia disabled the Score extension on their platforms in July 2020 (MediaWiki).

The ultimate solution was implemented in LilyPond 2.24, which removed the safe mode entirely rather than attempting to maintain a broken security feature. For systems that must process untrusted LilyPond files, it is recommended to use additional sandboxing measures such as running LilyPond in a restricted environment. Wikimedia implemented isolation using Shellbox for their Score extension. It's recommended to only enable Score and LilyPond on wikis where all users with editing privileges are trusted, or when proper containment mechanisms are in place (MediaWiki, Debian Tracker).

The vulnerability led to significant changes in how LilyPond's security was perceived and handled. Debian added explicit security warnings about LilyPond's insecurity for external data files in their documentation. Wikimedia temporarily disabled their Score extension and later re-enabled it with additional security measures. The LilyPond developers ultimately decided to remove the safe mode feature entirely, acknowledging that it was better not to promise security that couldn't be delivered (Phabricator, MediaWiki).