CVE-2022-23646
Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.80% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-451
- Affected
- vercel/next.js
- Source
- security-advisories@github.com
References
- https://github.com/vercel/next.js/pull/34075Issue Tracking, Patch, Third Party Advisory
- https://github.com/vercel/next.js/releases/tag/v12.1.0Release Notes, Third Party Advisory
- https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mjIssue Tracking, Mitigation, Patch, Third Party Advisory
- https://github.com/vercel/next.js/pull/34075Issue Tracking, Patch, Third Party Advisory
- https://github.com/vercel/next.js/releases/tag/v12.1.0Release Notes, Third Party Advisory
- https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mjIssue Tracking, Mitigation, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.