{"action":"Upgrade sharp to 0.30.5 or later.","affected":[{"fixed":"0.30.5","introduced":"0"}],"component":"sharp","cve_ids":["CVE-2022-29256"],"ecosystem":"npm","epss":0.00385,"exploited":false,"fixed_versions":["0.30.5"],"ghsa_id":"GHSA-gp95-ppv5-3jc5","id":"tcs_01M5KFS60ZMFQ9B37CGHKXTB71","modified_at":"2023-11-08T04:09:12.597610Z","published_at":"2022-06-01T19:58:29Z","references":["https://osv.dev/vulnerability/GHSA-gp95-ppv5-3jc5","https://github.com/lovell/sharp/security/advisories/GHSA-gp95-ppv5-3jc5","https://nvd.nist.gov/vuln/detail/CVE-2022-29256","https://github.com/lovell/sharp/commit/a6aeef612be50f5868a77481848b1de674216f0c","https://advisory.dw1.io/54","https://github.com/lovell/sharp"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-gp95-ppv5-3jc5","url":"https://osv.dev/vulnerability/GHSA-gp95-ppv5-3jc5"}],"summary":"sharp vulnerable to Command Injection in post-installation over build environment"}