{"id":"GHSA-54xq-cgqr-rpm3","aliases":[],"url":"https://o3.security/vulnerability/GHSA-54xq-cgqr-rpm3","summary":"sharp vulnerability in libwebp dependency CVE-2023-4863","details":"## Overview\n\nsharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.\n\n## Who does this affect?\n\nAlmost anyone processing untrusted input with versions of sharp prior to 0.32.6.\n\n## How to resolve this?\n\n### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.\n\n### Using a globally-installed libvips?\n\nPlease ensure you are using the latest libwebp 1.3.2.\n\n## Possible workaround\n\nAdd the following to your code to prevent sharp from decoding WebP images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadWebp\"] });\n```","published":"2023-11-16T17:14:15Z","modified":"2023-11-16T17:14:15Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"sharp","fixedVersion":"0.32.6"}],"fix":{"url":"https://github.com/lovell/sharp/commit/dbce6fab795ca4250bda9b1ef502c1fdb7d4a30c","label":"lovell/sharp@dbce6fa"},"references":[{"type":"WEB","url":"https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3"},{"type":"WEB","url":"https://github.com/lovell/sharp/commit/dbce6fab795ca4250bda9b1ef502c1fdb7d4a30c"},{"type":"PACKAGE","url":"https://github.com/lovell/sharp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-16T17:14:15Z"}}