Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment

Vulnerability

In sharp versions prior to 0.30.5, the post-install script in lib/libvips.js constructs a shell command by concatenating the PKG_CONFIG_PATH environment variable without sanitization. Specifically, line 68 runs spawnSync(PKG_CONFIG_PATH="${pkgConfigPath()}" pkg-config --modversion vips-cpp, ...). An attacker with control over this environment variable can inject arbitrary commands. This code path is only executed during npm install on non-Windows platforms [1][3].

Exploitation

An attacker must have the ability to set the PKG_CONFIG_PATH environment variable in the build environment (e.g., via a malicious package or compromised CI). The attack is triggered when a user or automated process runs npm install sharp. For example, setting PKG_CONFIG_PATH='"; touch pwned #' leads to command execution during installation [3]. No runtime interaction or user privilege escalation is required beyond the build context.

Impact

Successful exploitation results in arbitrary command execution with the privileges of the user running npm install. This can lead to full compromise of the build environment, including disclosure of credentials, source code, and artifacts. The CVSS v3 base score is 5.9 (Medium) due to high privileges required and user interaction, but real-world impact depends on the build environment's security posture [1][4].

Mitigation

Upgrade sharp to version 0.30.5 or later, released on 23 May 2022, which contains the fix in commit a6aeef6 [4]. No workaround is available for vulnerable versions. Windows users are unaffected. The vendor notes that any attacker with control over environment variables in the build environment poses a larger security issue [1][4].