CVE-2022-3008

Command Injection on tinygltf

State: Published
Severity: 8.1 High
Published: Sep 5, 2022
Updated: Apr 21, 2025
Reserved: Aug 26, 2022

Description

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Google

Weaknesses

CWE-78 OS Command Injection

Affected Products

Product	Versions
tinygltfsyoyo	before 2.6.0Affected

References

https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751
https://github.com/syoyo/tinygltf/issues/368
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053
https://github.com/syoyo/tinygltf/blob/master/README.md
DSA-5232vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.