Spotted what might be an issue in bun.lock around line 286.
This HIGH severity vulnerability affects sharp versions prior to 0.35.0 due to multiple flaws in the upstream libvips dependency. Processing untrusted image data (particularly GIF, TIFF, and VIPS formats) can cause application crashes, denial of service, or potential remote code execution. Risk Level: HIGH. Impact is critical for any service processing user-uploaded or untrusted media files.
Something like this might fix it:
Update package.json to require the patched version:
- "sharp": "0.34.5",
+ "sharp": "^0.35.0",
After updating the dependency, regenerate your lockfile by running:
bun install
For reference: rule GHSA-f88m-g3jw-g9cj. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
bun.lockaround line 286.This HIGH severity vulnerability affects sharp versions prior to 0.35.0 due to multiple flaws in the upstream libvips dependency. Processing untrusted image data (particularly GIF, TIFF, and VIPS formats) can cause application crashes, denial of service, or potential remote code execution. Risk Level: HIGH. Impact is critical for any service processing user-uploaded or untrusted media files.
Something like this might fix it:
For reference: rule
GHSA-f88m-g3jw-g9cj. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.