Vulnerability in opencv-python: CVE-2023-4863
Summary
GHSA-qr4w-53vh-m672: opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. Affects opencv-python versions < 4.8.1.78. Fixed in 4.8.1.78. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The opencv-python package is a Python wrapper for the OpenCV computer vision library. It provides various functions and tools for image and video processing. The package allows developers to utilize the capabilities of OpenCV in their Python applications. However, opencv-python versions before v4.8.1.78 include vulnerable libwebp binaries in their wheels. This vulnerability, identified as CVE-2023-4863, poses a significant security risk.
Vulnerability Detail
The opencv-python package, prior to version v4.8.1.78, bundles libwebp binaries in its wheels that are vulnerable to CVE-2023-4863. This vulnerability can lead to various consequences, including remote code execution, denial of service, and information disclosure. The vulnerability arises from the outdated libwebp binary version used by opencv-python. To mitigate the risk, it is crucial to update to opencv-python v4.8.1.78, which includes an upgraded libwebp binary (v1.3.2).
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.8.1.78
This is the first release that contains the fix.
pip install --upgrade "opencv-python==4.8.1.78"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The opencv-python package prior to v4.8.1.78 includes vulnerable libwebp binaries, which can lead to severe security risks. It is crucial to update to opencv-python v4.8.1.78 or later to address this vulnerability and ensure the security of your Python applications.
See every vulnerability recorded for opencv-python →
FAQ
The opencv-python package is a Python wrapper for the OpenCV computer vision library. It provides functions and tools for image and video processing in Python applications.
CVE-2023-4863 is a vulnerability that affects the libwebp binaries bundled in opencv-python versions prior to v4.8.1.78. It can lead to remote code execution, denial of service, and information disclosure.
The vulnerability can allow attackers to execute arbitrary code on the affected system, disrupt services through denial of service attacks, and potentially access sensitive information.
To fix this vulnerability, update the opencv-python package to version 4.8.1.78 or later. Ensure the updated package is installed in your Python environment.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
