What is GHSA-4whq-r978-2x68?

GHSA-4whq-r978-2x68 is a security advisory published by GitHub Security Advisories with High severity. Arbitrary code execution in ExifTool

Why does GHSA-4whq-r978-2x68 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-4whq-r978-2x68?

GHSA-4whq-r978-2x68 has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-4whq-r978-2x68?

GHSA-4whq-r978-2x68 affects 1 product, including: npm/exiftool-vendored:\u003c 14.3.0.

GHSA-4whq-r978-2x68HighCVSS 7.8Disclosed before NVD

Arbitrary code execution in ExifTool

Vendor

GitHub Security Advisories

Published

May 4, 2021

Last Modified

January 9, 2023

📋 Description

Impact

Arbitrary code execution can occur when running exiftool against files with hostile metadata payloads.

Patches

ExifTool has already been patched in version 12.24. exiftool-vendored, which vendors ExifTool, includes this patch in v14.3.0.

Workarounds

No.

References

https://twitter.com/wcbowling/status/1385803927321415687 https://nvd.nist.gov/vuln/detail/CVE-2021-22204

For more information

If you have any questions or comments about this advisory:

Open an issue in exiftool-vendored

🎯 Affected products1

npm/exiftool-vendored:< 14.3.0

🔗 References (2)

https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-4whq-r978-2x68
https://github.com/advisories/GHSA-4whq-r978-2x68