{"id":"GHSA-54xq-cgqr-rpm3","summary":"sharp vulnerability in libwebp dependency CVE-2023-4863","details":"## Overview\n\nsharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.\n\n## Who does this affect?\n\nAlmost anyone processing untrusted input with versions of sharp prior to 0.32.6.\n\n## How to resolve this?\n\n### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.\n\n### Using a globally-installed libvips?\n\nPlease ensure you are using the latest libwebp 1.3.2.\n\n## Possible workaround\n\nAdd the following to your code to prevent sharp from decoding WebP images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadWebp\"] });\n```","modified":"2023-11-16T17:14:15Z","published":"2023-11-16T17:14:15Z","database_specific":{"github_reviewed_at":"2023-11-16T17:14:15Z","nvd_published_at":null,"cwe_ids":[],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3"},{"type":"WEB","url":"https://github.com/lovell/sharp/commit/dbce6fab795ca4250bda9b1ef502c1fdb7d4a30c"},{"type":"PACKAGE","url":"https://github.com/lovell/sharp"}],"affected":[{"package":{"name":"sharp","ecosystem":"npm","purl":"pkg:npm/sharp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.32.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-54xq-cgqr-rpm3/GHSA-54xq-cgqr-rpm3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}