Spotted what might be an issue in pnpm-lock.yaml around line 1.
This finding indicates multiple high-severity CVSSv4 vulnerabilities in the upstream libvips library, which powers the sharp image processing package. These vulnerabilities can be exploited when processing untrusted media files (specifically GIF, TIFF, and VIPS formats), potentially leading to denial of service, memory corruption, or remote code execution. The risk level is HIGH due to the direct exposure to user-uploaded content. Immediate upgrade is required to mitigate the threat.
Something like this might fix it:
Update the sharp dependency in your package.json to at least version 0.35.0:
```diff
--- a/package.json
+++ b/package.json
@@ -X,X +X,X @@
- "sharp": "^0.34.5",
+ "sharp": "^0.35.0",
```
After making this change, run `pnpm install` to regenerate the lockfile and rebuild any native modules.
For reference: rule GHSA-f88m-g3jw-g9cj. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
pnpm-lock.yamlaround line 1.This finding indicates multiple high-severity CVSSv4 vulnerabilities in the upstream libvips library, which powers the sharp image processing package. These vulnerabilities can be exploited when processing untrusted media files (specifically GIF, TIFF, and VIPS formats), potentially leading to denial of service, memory corruption, or remote code execution. The risk level is HIGH due to the direct exposure to user-uploaded content. Immediate upgrade is required to mitigate the threat.
Something like this might fix it:
For reference: rule
GHSA-f88m-g3jw-g9cj. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.