Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-n45w-tfmt-z3cj
|
sharp vulnerability in libwebp dependency CVE-2023-4863
## Overview
sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.
## Who does this affect?
Almost anyone processing untrusted input with versions of sharp prior to 0.32.6.
## How to resolve this?
### Using prebuilt binaries provided by sharp?
Most people rely on the prebuilt binaries provided by sharp.
Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.
### Using a globally-installed libvips?
Please ensure you are using the latest libwebp 1.3.2.
## Possible workaround
Add the following to your code to prevent sharp from decoding WebP images.
```js
sharp.block({ operation: ["VipsForeignLoadWebp"] });
```
|
GHSA-54xq-cgqr-rpm3
GMS-2023-4343
|