CVE-2022-29256: Command Injection in sharp Package
Summary
CVE-2022-29256: sharp vulnerable to Command Injection in post-installation over build environment. Affects sharp versions < 0.30.5. Fixed in 0.30.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The sharp package is an open-source image processing library for Node.js. It provides a simple and efficient API for resizing, cropping, and manipulating images. The package is widely used in web applications and other projects that require image processing capabilities. However, versions of sharp prior to v0.30.5 are vulnerable to a command injection vulnerability during the post-installation process in the build environment. This vulnerability can be exploited if an attacker can set the value of the PKG_CONFIG_PATH environment variable during the npm install command.
Vulnerability Detail
The vulnerability in sharp arises from a logic flaw that is executed only during the npm install process. If an attacker can control the PKG_CONFIG_PATH environment variable, they can inject arbitrary commands during the installation of vulnerable versions of sharp. This can lead to remote code execution and compromise the security of the build environment. The impact of this vulnerability is considered moderate, with a CVSS score of 6.5. However, it is important to note that this vulnerability does not affect Windows users and is unlikely to impact those who already prioritize the security of their build environment.
How To Fix
Minimum fixed version
0.30.5
This is the first release that contains the fix.
npm install sharp@0.30.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the latest version of the sharp package to mitigate the risk.
Conclusion
The sharp package prior to v0.30.5 is vulnerable to a command injection issue during the post-installation process. It is crucial to update to the latest version of the package to mitigate the risk of remote code execution and compromise of the build environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sharp →
FAQ
The sharp package is an open-source image processing library for Node.js. It provides a simple and efficient API for resizing, cropping, and manipulating images.
The vulnerability allows an attacker to inject arbitrary commands during the installation of vulnerable versions of sharp. This can lead to remote code execution and compromise the security of the build environment.
Users of sharp versions prior to v0.30.5 are affected by this vulnerability. However, it is important to note that this vulnerability does not impact Windows users and is unlikely to affect those who prioritize the security of their build environment.
To fix this vulnerability, it is recommended to update the sharp package to the latest version (v0.30.5 or later) by running the command: npm install sharp@latest.
There are no known workarounds for this vulnerability. It is crucial to update to the latest version of the sharp package to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for sharp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
