CVE-2022-39239

netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is cached globally, this image will then be served to visitors without requiring those headers to be set. XSS can be achieved by requesting a malicious SVG with embedded scripts, which would then be served from the site domain. Note that this does not apply to images loaded in `<img>` tags, as scripts do not execute in this context. The image URL can be set in the header independently of the request URL, meaning any site images that have not previously been cached can have their cache poisoned. This problem has been fixed in version 1.2.3. As a workaround, cached content can be cleared by re-deploying the site.

• CWE-79
• CWE-918

• https://github.com/netlify/netlify-ipx/security/advisories/GHSA-9jjv-524m-jm98Third Party Advisory
• https://github.com/netlify/netlify-ipx/security/advisories/GHSA-9jjv-524m-jm98Third Party Advisory

Published

Sep 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39232Discourse is an open source discussion platform. Starting wi…4.3
• CVE-2022-39233Tuleap is a Free & Open Source Suite to improve management o…5.4
• CVE-2022-39234GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…8.8
• CVE-2022-39236Matrix Javascript SDK is the Matrix Client-Server SDK for Ja…5.3
• CVE-2022-39237syslabs/sif is the Singularity Image Format (SIF) reference …9.8
• CVE-2022-39238Arvados is an open source platform for managing and analyzin…8.8
• CVE-2022-3924This issue can affect BIND 9 resolvers with `stale-answer-en…7.5
• CVE-2022-39240MyGraph is a permission management system. Versions prior to…5.4
• CVE-2022-39241Discourse is a platform for community discussion. A maliciou…4.9
• CVE-2022-39242Frontier is an Ethereum compatibility layer for Substrate. P…5.3
• CVE-2022-39243NuProcess is an external process execution implementation fo…9.8
• CVE-2022-39244PJSIP is a free and open source multimedia communication lib…9.8