Homepage

gm@1.14.0 vulnerabilities

GraphicsMagick and ImageMagick for node.js

  • latest version

    1.25.1

  • latest non vulnerable version

    1.25.1

  • first published

    14 years ago

  • latest version published

    7 months ago

  • deprecated

    Package is deprecated

  • licenses detected

  • View gm package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the gm package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Remote Shell Command Injection

    The gm package is the GraphicsMagick and ImageMagick wrapper for Node.js. The compare() function allows comparing of two images, taking as an input argument the path to both images. The function, in versions prior to 1.21.1, fails to sanitize the input correctly, making it vulnerable to a command injection attack.

    How to fix Remote Shell Command Injection?

    Upgrade gm to version 1.21.1 or greater.

    If a direct dependency update is not possible, use snyk wizard to patch this vulnerability.

    <1.21.0
    Go back to all versions of this package