CVE-2022-29256
Description
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKG_CONFIG_PATH environment variable in a build environment then they might be able to use this to inject an arbitrary command at npm install time. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. This problem is fixed in version 0.30.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sharpnpm | < 0.30.5 | 0.30.5 |
Affected products
3- lovell/sharpv5Range: < 0.30.5
Patches
Vulnerability mechanics
References
5- github.com/lovell/sharp/commit/a6aeef612be50f5868a77481848b1de674216f0cnvdPatchThird Party AdvisoryWEB
- github.com/lovell/sharp/security/advisories/GHSA-gp95-ppv5-3jc5nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-gp95-ppv5-3jc5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-29256ghsaADVISORY
- advisory.dw1.io/54ghsaWEB
News mentions
0No linked articles in our index yet.