Remote Code Execution (RCE) Affecting sharp package, versions <0.30.5
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SHARP-2848109
- published 26 May 2022
- disclosed 26 May 2022
- credit Dwi Siswanto
Introduced: 26 May 2022
CVE-2022-29256 Open this link in a new tabHow to fix?
Upgrade sharp to version 0.30.5 or higher.
Overview
sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images
Affected versions of this package are vulnerable to Remote Code Execution (RCE). There is a possible vulnerability in logic that is run only at npm install time when installing the package. If an attacker has the ability to set the value of the PKG_CONFIG_PATH environment variable in a build environment then they might be able to use this to inject an arbitrary command at npm install time. This is not part of any runtime code and does not affect Windows users at all.