Vulnerability in imagecodecs: Bundled libwebp
Summary
GHSA-94vc-p8w7-5p49: Bundled libwebp in imagecodecs vulnerable. Affects imagecodecs versions < 2023.9.18. Fixed in 2023.9.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The imagecodecs package is a Python library that provides support for various image codecs and formats. It allows users to encode and decode images using different compression algorithms. However, versions of imagecodecs prior to v2023.9.18 include vulnerable libwebp binaries in their wheels. This vulnerability, known as CVE-2023-5129 (previously CVE-2023-4863), can lead to potential security issues.
Vulnerability Detail
The bundled libwebp binaries in imagecodecs versions before v2023.9.18 are susceptible to CVE-2023-5129. This vulnerability could allow attackers to exploit the library and potentially execute arbitrary code or cause a denial-of-service attack. The vulnerability has been addressed in imagecodecs v2023.9.18, which includes an upgraded libwebp binary (v1.3.2). It is crucial to update to the fixed version to mitigate the risk.
How To Fix
Latest published version: 2026.10.10 as of 23 Oct 2026
pip install --upgrade "imagecodecs==2026.10.10"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2023.9.18
This is the first release that contains the fix.
pip install --upgrade "imagecodecs==2023.9.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in imagecodecs, caused by the bundled libwebp binaries, can pose a significant security risk. It is crucial to update to imagecodecs v2023.9.18 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for imagecodecs →
FAQ
imagecodecs is a Python library that provides support for various image codecs and formats. It allows users to encode and decode images using different compression algorithms.
The vulnerability in imagecodecs is related to the bundled libwebp binaries. Versions prior to v2023.9.18 include a vulnerable libwebp binary that can be exploited by attackers.
CVE-2023-5129 is a vulnerability that affects the bundled libwebp binaries in imagecodecs. It can potentially allow attackers to execute arbitrary code or cause a denial-of-service attack.
To fix the vulnerability, you should upgrade the imagecodecs package to v2023.9.18 or later. This can be done by running the command 'pip install --upgrade imagecodecs'.
No specific workaround has been mentioned for this vulnerability. It is recommended to update to the fixed version of imagecodecs.
Related vulnerabilities
Recent vulnerabilities recorded for imagecodecs.
