{"id":"CVE-2022-3008","summary":"Command Injection on tinygltf","details":"The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751","modified":"2026-08-12T13:01:07.764406Z","published":"2022-09-05T09:10:11Z","database_specific":{"cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3008.json","unresolved_ranges":[{"extracted_events":[{"fixed":"2.6.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"Google"},"references":[{"type":"WEB","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053"},{"type":"WEB","url":"https://github.com/syoyo/tinygltf/blob/master/README.md"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3008.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3008"},{"type":"ADVISORY","url":"https://www.debian.org/security/2022/dsa-5232"},{"type":"REPORT","url":"https://github.com/syoyo/tinygltf/issues/368"},{"type":"FIX","url":"https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/syoyo/tinygltf","events":[{"introduced":"0"},{"fixed":"52ff00a38447f06a17eab1caa2cf0730a119c751"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v2.5.0","v2.4.0","v2.2.0","v2.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3008.json","vanir_signatures_modified":"2026-08-12T13:01:07Z","vanir_signatures":[{"source":"https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751","target":{"file":"tiny_gltf.h"},"deprecated":false,"digest":{"line_hashes":["178603724187780315448546801427692657330","33305958886947855135596730315907585341","50524497936313504722469999605492479730","49387870799833177163606399454062871753","173345772007478732004536535113681409326","306935247044614731960569364115716230698","104131339540274119160674053157628305183","306092539256672606817878310547385822253","139606675959326901705484311984099595883","211147101725340896735888893346161061229","50666595107034866869945088026000060101","194405035341419210763341035407824030292","265097712822329515494501680365793553108","144270566180703108429027688923616881605","169361832292050778933160556555389823175","42326534885723619155607703315357635096","145561135508467613004628930359101815020","89522478641110902667365801684394170840","337368112719022302148306866316832025914","297471540017423545720897727437090145353","326829528449774792947480649917030266929","220793185688445689054750030835861553382","75561573408192202981480749257029673884","104210642680478113913031997334829167413","49094380434617486175743985069142845448","259672834319572051419546440617013413248","31931249280672366152298248422825483328","97970695645285702255902529603573062815","24609380189243914026584964253212259971","250650004484888496488255168081258057811","54064202282641914629867774589806568756","313351101464083999322026507010837613280","336935128525549144596979797620207098353","106683663848790314168868351301179841365","29454809971453561012690476132813489730","11241647776658584509514571036167923431","114364124705445643483499570138453452738","124298345786412867042650059130464551632","70989816053876490709298393386709086242","57171352763374522464001535448567138742","114861073240472344388006842269569659760","187887765437719910412339410770048050918","328686211188749816467100883716979641437","116079725950760460543199944833630199737","101577247778463799590679047335385070205","334386445961178942958810149813910185031","260009227293958257250516707402743607057","62043834239205456127943992222333363809","52508645564652714500330525924869675286","195110325844374010617676144372679256052","338106849818983663693562670755584851217","17993429713514632805634199721272502362","183898980325040317785022203874563441041","61448235475072358685051444280460897397","8383868207253064785906935849512810963","60977867865949908192594830256679075031","144543741988847650785754070068900672161","71403282088404068672786058674055214373","245972468367472085395378959397270730211","147063809698480460956001098997857425048","16566608947528227910564863306244003489","252462363618613687330840298915732347962","45004493917998597836311292855534318951","283500142658447882023588614186345523806","296435211393241098919945585416710320237","190237050556189736182538811369958442152","15050212740855517534284620535579225540","156780968480425008451186519928495822281","41327341508306416795629137085182844525"],"threshold":0.9},"id":"CVE-2022-3008-03dcb3e9","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751","target":{"file":"tiny_gltf.h","function":"ExpandFilePath"},"deprecated":false,"digest":{"length":811,"function_hash":"305110897577798341254889502656475064988"},"id":"CVE-2022-3008-15536fcc"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}