CVE-2021-45463

Name of the Vulnerable Software and Affected Versions GIMP versions prior to 2.10.30 GEGL versions prior to 0.4.34

Description The issue is related to the load cache function in GEGL, which is used by GIMP. It allows shell expansion when a pathname in a constructed command line is not escaped or filtered, due to the use of the system library function for execution of the ImageMagick convert fallback in magick-load. This can be exploited by a remote attacker to execute arbitrary commands on the target system by passing special data to the application.

Recommendations For GEGL versions prior to 0.4.34, update to version 0.4.34 or later to resolve the issue. For GIMP versions prior to 2.10.30, update to version 2.10.30 or later to resolve the issue. As a temporary workaround, consider disabling the magick-load feature in GEGL until a patch is available. Restrict access to the load cache function to minimize the risk of exploitation.