Executive brief
sharp is a widely used Node.js library for fast image processing and resizing. A critical vulnerability in its bundled libwebp dependency can allow attackers to execute arbitrary code or crash the application when processing maliciously crafted WebP images. This affects any application using sharp to process untrusted image files, potentially leading to data theft or system compromise.
Technical details
The vulnerability is a buffer overflow in libwebp (CVE-2023-4863), which sharp uses for decoding WebP images. The root cause lies in improper bounds checking when processing malformed WebP image data. The attack vector is local and requires user interaction (opening/processing a crafted WebP file), but no special privileges are needed. An attacker can craft a malicious WebP image that, when decoded by a vulnerable version of sharp, triggers a heap or stack buffer overflow leading to arbitrary code execution, information disclosure, or denial of service. The vulnerability is fixed in sharp 0.32.6, which bundles libwebp 1.3.2. Users with globally-installed libvips should upgrade libwebp to version 1.3.2 or later. A workaround is available to block WebP decoding in sharp via the block() API.
Affected products
- lovell sharp < 0.32.6
- libwebp < 1.3.2
Timeline
- 2023-11-16: disclosed: GHSA-54xq-cgqr-rpm3 advisory published
- 2023-11-16: patched: sharp version 0.32.6 released with libwebp 1.3.2