Repository navigation
amcli ships a vulnerable SixLabors.ImageSharp through a reference it does not use #2114
Description
AngouriMath.Terminal (amcli) references Spectre.Console.ImageSharp 0.54.0, which brings in SixLabors.ImageSharp 3.1.12. That version has five advisories, all fixed only in 4.1.2:
| advisory | severity | |
|---|---|---|
| GHSA-j3p4-wp97-rph4 | high | HistogramEqualization indexes with an unvalidated luminance |
| GHSA-j9gm-c75j-xc9q | high | the TIFF CCITT T4 encoder writes past its output buffer |
| GHSA-jjfr-hcj7-qf5w | high | the TIFF CCITT T6 encoder writes past an undersized output buffer |
| GHSA-gwg2-r3hj-4w44 | moderate | ICC CLUT parsing allocates from unvalidated dimensions |
| GHSA-wmxv-xphr-5c9g | moderate | a BigTIFF IFD count can stall a decoder thread |
dotnet list Sources/Terminal/AngouriMath.Terminal package --vulnerable --include-transitive lists all five, every restore of the Terminal prints them as NU1902/NU1903, and the published 2.6.0 tool ships SixLabors.ImageSharp.dll.
Nothing in amcli calls it. The reference came in with #484 in 2021 and no code has used it since (git log -S CanvasImage is empty), so amcli never decodes or encodes an image. A newer Spectre does not help: the latest Spectre.Console.ImageSharp, 0.57.3-alpha.0.29, still depends on 3.1.12.
The fix is to remove the reference. Part of #542.
Activity