CVE-2022-3008

High

Description

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751

SeverityHigh

CVSS8.1

Exploit probability—

Product

Tinygltf

PublishedSep 5, 2022

First seenSep 5, 2022

Weakness typeCWE-78OS command injection

How to fix

Update

tinygltf_project tinygltf2.6.0 or later

Vendor advisories

debian.org/security/2022/dsa-5232

Affected products

Product	Affected versions	Fixed in
tinygltf_project tinygltf	v < 2.6.0	2.6.0
debian debian_linux	11.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.