Shell Expansion Vulnerability in GEGL Affecting GIMP

CVE-2021-45463

What is CVE-2021-45463?

A vulnerability in the GEGL library allows for shell command injection due to improper handling of pathnames in constructed command lines. This is particularly concerning as it facilitates unsafe use of the system library function to execute commands in situations where the ImageMagick convert fallback is invoked. Affected versions include GEGL prior to 0.4.34, which is utilized in GIMP versions before 2.10.30, creating potential risk for users who may leverage these older software releases. Users are recommended to upgrade to the latest versions to mitigate potential exploitation risks.

References