High severity8.1NVD Advisory· Published Sep 5, 2022· Updated Jun 17, 2026
CVE-2022-3008
CVE-2022-3008
Description
The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4Patches
Vulnerability mechanics
References
5- github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751nvdPatchThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detailnvdExploitIssue TrackingMailing ListThird Party Advisory
- github.com/syoyo/tinygltf/issues/368nvdExploitIssue TrackingPatchThird Party Advisory
- github.com/syoyo/tinygltf/blob/master/README.mdnvdProductThird Party Advisory
- www.debian.org/security/2022/dsa-5232nvdThird Party Advisory
News mentions
0No linked articles in our index yet.