Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

gatsby-plugin-sharp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3npmAmendedPublished

    Path traversal vulnerability in gatsby-plugin-sharp

    CVE-2023-30548 · GHSA-h2pm-378c-pcxx

    Affected
    • npm gatsby-plugin-sharp >= 5.0.0, < 5.8.1; < 4.25.1
    Fixed in
    4.25.15.8.1· Vendor fix available
    Issue
    Impact The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Gatsby develop server (gatsby develop). The following steps can be used to reproduce the vulnerability: It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBYHOST=0.0.0.0 environment variable. Patches A patch has been introduced in gatsby-plugin-sharp@5.8.1 and gatsby-plugin-sharp@4.25.1 which mitigates the issue by ensuring that included paths remain within the project directory. Workarounds As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being…

    Recommended action: Upgrade to 5.8.1 or 4.25.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →