GHSA-wq5f-xc86-pv6w found in npm/[email protected]
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 66/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, next.js, node.js
- Domain
- security
Research direction
Locate the package.json and lockfile for devguard-web (the npm/Next.js app referenced in the dependency path) and confirm where [email protected] comes from — it is a transitive dependency of next/@sentry/nextjs, so an npm overrides entry may be needed rather than a direct install. Upgrade to [email protected] or newer, regenerate the lockfile, and verify with npm audit that GHSA-wq5f-xc86-pv6w is cleared; done means the scan report no longer lists the advisory.
Written by the indexing model from the issue text.
Description
GHSA-wq5f-xc86-pv6w found in npm/[email protected]
[!important]
Risk:0.74 (Low)
CVSS:8.9
Description
Impact
A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.
Patches
Using prebuilt binaries provided by sharp?
Most people rely on the prebuilt binaries provided by sharp.
Please upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.
Using a globally-installed librsvg?
Please ensure you are using the latest librsvg 2.63.2.
Workarounds
Add the following to your code to prevent sharp from decoding SVG images.
sharp.block({ operation: ["VipsForeignLoadSvg"] });
To avoid RCE, ensure you are using a node executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the "official" Node.js binaries do not.
1
Affected component
The vulnerability is in pkg:npm/[email protected], found in artifacts pkg:oci/devguard-web?repository_url=ghcr.io/l3montree-dev/devguard-web&arch=amd64&tag=main-amd64, pkg:oci/devguard-web?repository_url=ghcr.io/l3montree-dev/devguard-web&arch=arm64&tag=main-arm64, pkg:oci/web?repository_url=registry.opencode.de/oci-community/images/l3montree/devguard/web&arch=amd64&tag=main-amd64, pkg:oci/web?repository_url=registry.opencode.de/oci-community/images/l3montree/devguard/web&arch=arm64&tag=main-arm64.
Recommended fix
Upgrade to version 0.35.5 or later.
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install [email protected]
Additional guidance for mitigating vulnerabilities
Visit our guides on devguard.org
See more details...
Path to component
%%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
flowchart TD
Your_application(["Your application"]) --- pkg_npm_devguard_web_1_15_1(["pkg:npm/devguard-web\@1.15.1"])
pkg_npm_devguard_web_1_15_1(["pkg:npm/devguard-web\@1.15.1"]) --- pkg_npm__sentry_nextjs_10_71_0(["pkg:npm/\@sentry/nextjs\@10.71.0"])
pkg_npm__sentry_nextjs_10_71_0(["pkg:npm/\@sentry/nextjs\@10.71.0"]) --- pkg_npm_next_16_3_6(["pkg:npm/next\@16.3.6"])
pkg_npm_next_16_3_6(["pkg:npm/next\@16.3.6"]) --- pkg_npm_sharp_0_35_4(["pkg:npm/sharp\@0.35.4"])
classDef default stroke-width:2px
| Risk Factor | Value | Description |
|---|---|---|
| Vulnerability Depth | 4 |
The vulnerability is in a dependency of a dependency in your project. It is 4 levels deep. |
| EPSS | 0.00 % |
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. |
| EXPLOIT | Not available |
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. |
| CVSS-BE | 8.9 |
|
| CVSS-B | 8.9 |
- The vulnerability requires local access to the device to be exploited. - It is easy for an attacker to exploit this vulnerability. - An attacker does not need any special privileges or access rights. - No user interaction is needed for the attacker to exploit this vulnerability. |
More details can be found in DevGuard
Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:
👍 Reply with this to acknowledge and accept the identified risk.
/accept I accept the risk of this vulnerability, because ...
⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
/component-not-present The vulnerable component is not included in the artifact.
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
/reopen ...
- Dominant language
- Go
- Stars
- 178
- Forks
- 46
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 30
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from l3montree-dev/devguard
-
[Usability] Wording rsp. inconcise referencePossibly taken @Ph4t3 claimed this 7 days ago. Opencomponent/devguard-web
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
l3montree-dev/devguard#3191 · 1 assignee ·
Maintainers usually reply within 1 day
-
component/devguard-documentation priority:high
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
l3montree-dev/devguard#3101 ·
Maintainers usually reply within 1 day
-
component/devguard-documentation
Difficulty 1/5 Under an hour Newbie friendliness 90/100
l3montree-dev/devguard#3090 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
l3montree-dev/devguard#3049 ·
Maintainers usually reply within 1 day
-
component/devguard-documentation
Difficulty 1/5 1-3 hours Newbie friendliness 85/100
l3montree-dev/devguard#2926 ·
Maintainers usually reply within 1 day
All issues in l3montree-dev/devguard
Similar issues
-
Handler accepts zero/negative NNCP_MAX_RETRIES and NNCP backoff values, stalling policies or hot-loopingPossibly taken @NopeCharon claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nmstate/kubernetes-nmstate#1604 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
bug raised-by:desk
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
medici-finance/assay#4723 ·
Maintainers usually reply within 1 day
-
[doc-healer] DDUw improvement: retry integrity-filtered issue reads with direct single-item lookupsOpenautomation documentation
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
flannel-io/flannel#2608 ·
Maintainers usually reply within 2 days