Skip to content
OpenAdvisories
High USN-7129-1 1 CVE

TinyGLTF vulnerability

Published Nov 26, 2024 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that TinyGLTF performed file path expansion in an
insecure way on certain inputs. An attacker could possibly use this
issue to cause a denial of service, or execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS tinygltf 2.5.0+dfsg-4ubuntu0.1

Vulnerabilities 1

  • High 8.1
    CVE-2022-3008

    Command Injection on tinygltf

    The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input …

    syoyo tinygltf tinygltf tinygltf Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2022-3008