CVE-2022-29256

 

Published at: - 26-05-2022 12:15

Last modified: - 07-06-2022 05:28

Total changes: - 3

Description

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` environment variable in a build environment then they might be able to use this to inject an arbitrary command at `npm install` time. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. This problem is fixed in version 0.30.5.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/lovell/sharp/security/advisories/GHSA-gp95-ppv5-3jc5
• https://github.com/lovell/sharp/commit/a6aeef612be50f5868a77481848b1de674216f0c

 

Keywords

NVD

 

CVE-2022-29256

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures