CVE-2022-29256

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` environment variable in a build environment then they might be able to use this to inject an arbitrary command at `npm install` time. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. This problem is fixed in version 0.30.5.

• CWE-77
• CWE-78

• https://github.com/lovell/sharp/commit/a6aeef612be50f5868a77481848b1de674216f0cPatch, Third Party Advisory
• https://github.com/lovell/sharp/security/advisories/GHSA-gp95-ppv5-3jc5Patch, Third Party Advisory
• https://github.com/lovell/sharp/commit/a6aeef612be50f5868a77481848b1de674216f0cPatch, Third Party Advisory
• https://github.com/lovell/sharp/security/advisories/GHSA-gp95-ppv5-3jc5Patch, Third Party Advisory

Published

May 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29250GLPI is a Free Asset and IT Management Software package, tha…6.5
• CVE-2022-29251XWiki Platform Flamingo Theme UI is a tool that allows custo…6.1
• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1
• CVE-2022-29253XWiki Platform is a generic wiki platform offering runtime s…2.7
• CVE-2022-29254silverstripe-omnipay is a SilverStripe integration with Omni…6.5
• CVE-2022-29255Vyper is a Pythonic Smart Contract Language for the ethereum…7.5
• CVE-2022-29257Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2022-29258XWiki Platform Filter UI provides a generic user interface t…6.1
• CVE-2022-2926The Download Manager WordPress plugin before 3.2.55 does not…4.9
• CVE-2022-29262Improper buffer restrictions in some Intel(R) Server Board B…6.7
• CVE-2022-29263On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x v…7.8
• CVE-2022-29264An issue was discovered in coreboot 4.13 through 4.16. On AP…9.8