CVE-2022-29256 Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment

2022-05-2521:20:12

CWE-77

GitHub_M

www.cve.org

cve-2022-29256

vulnerability

sharp

npm install

build environment

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

Percentile

5.2%

JSON

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKG_CONFIG_PATH environment variable in a build environment then they might be able to use this to inject an arbitrary command at npm install time. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. This problem is fixed in version 0.30.5.

CNA Affected

[
  {
    "product": "sharp",
    "vendor": "lovell",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.30.5"
      }
    ]
  }
]