Description
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lovell | sharp | < 0.35.4 | 0.35.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | sharp | < 0.35.4 | 0.35.4 | GHSA-rgj7-g3m4-5g8c |
References
- GitHub Security Advisory (GHSA-rgj7-g3m4-5g8c) vendor-advisory
- VulnCheck Advisory: Sharp before 0.35.4 RCE via bundled libheif AVIF decoding third-party-advisory