Every CVE Search/ Get API key

CVE-2021-45463

GEGL before 0.4.34, as used (for example) in GIMP before 2.10.30, allows shell expansion when a...

7.8 HighFix available

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.55%Up 0.5 points since Dec 23, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Record
CVE-2021-45463
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Record
CVE-2021-45463
Updated
2026-11-02
EUVDEUVD-2021-32229 No score

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Record
EUVD-2021-32229
Updated
2026-11-02
GitHub AdvisoriesGHSA-g9gv-9646-jvp8 7.8

GEGL before 0.4.34, as used (for example) in GIMP before 2.10.30, allows shell expansion when a...

GEGL before 0.4.34, as used (for example) in GIMP before 2.10.30, allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load.

Record
GHSA-g9gv-9646-jvp8
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALPINE-CVE-2021-45463 7.8

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Record
ALPINE-CVE-2021-45463
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.8

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Record
CVE-2021-45463
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 18 moreShow less
OSVDEBIAN-CVE-2021-45463 7.8

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Record
DEBIAN-CVE-2021-45463
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1488 7.8

gimp security update

GIMP is a cross-platform image editor available for GNU/Linux, OS X, Windows and more operating systems. It is free software, you can change its source code and distribute your changes. Whether you are a graphic designer, photographer, illustrator, or scientist, GIMP provides you with sophisticated tools to get your job done. You can further enhance your productivity with GIMP thanks to many customization options and 3rd party plugins.

Security Fix(es):

GEGL before 0.4.34, as used (for example) in GIMP before 2.10.30, allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load.(CVE-2021-45463)

Record
OESA-2022-1488
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0162 7.8

Red Hat Security Advisory: gegl security update

Record
RHSA-2022:0162
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0177 7.8

Red Hat Security Advisory: gegl04 security update

Record
RHSA-2022:0177
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0178 7.8

Red Hat Security Advisory: gegl04 security update

Record
RHSA-2022:0178
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0184 7.8

Red Hat Security Advisory: gegl04 security update

Record
RHSA-2022:0184
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:0177 7.8

Important: gegl04 security update

GEGL (Generic Graphics Library) is a graph-based image processing framework.

Security Fix(es):

  • gegl: shell expansion via a crafted pathname (CVE-2021-45463)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0177
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-45463 7.8

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Record
UBUNTU-CVE-2021-45463
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:0177 No score

Important: gegl04 security update

GEGL (Generic Graphics Library) is a graph-based image processing framework.

Security Fix(es):

  • gegl: shell expansion via a crafted pathname (CVE-2021-45463)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:0177
Updated
2026-11-02
OSVCLSA-2026-1791563692 No score

Fix CVE(s): CVE-2021-45463

  • SECURITY UPDATE: shell command injection via the image path
    • debian/patches/CVE-2021-45463.patch: run convert with g_spawn_sync() instead of system() in load_cache() (operations/common/magick-load.c)
    • CVE-2021-45463
Record
CLSA-2026-1791563692
Updated
2026-11-02
OSVMGASA-2022-0003 No score

Updated gegl packages fix security vulnerability

Fix shell expansion via crafted pathname in the ImageMagick convert fallback

Record
MGASA-2022-0003
Updated
2026-11-02
OSVopenSUSE-SU-2021:4209-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045).
Record
openSUSE-SU-2021:4209-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:4210-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045).
Record
openSUSE-SU-2021:4210-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11788-1 No score

gegl-0.4.34-2.1 on GA media

These are all security issues fixed in the gegl-0.4.34-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11788-1
Updated
2026-11-02
OSVSUSE-SU-2021:4193-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045).
Record
SUSE-SU-2021:4193-1
Updated
2026-11-02
OSVSUSE-SU-2021:4209-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045).
Record
SUSE-SU-2021:4209-1
Updated
2026-11-02
OSVSUSE-SU-2021:4210-1 No score

Security update for gegl

This update for gegl fixes the following issues:

  • CVE-2021-45463: fixed shell expansion via crafted pathname in the ImageMagick convert fallback (bsc#1194045).
Record
SUSE-SU-2021:4210-1
Updated
2026-11-02
OSVUSN-5251-1 No score

gegl vulnerability

It was discovered that GEGL incorrectly filtered and escaped file path input data when using the C system() function for execution of the ImageMagick convert command. An attacker could possibly use this to execute arbitrary code.

Record
USN-5251-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gegl
Alpine:v3.15
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.16
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.17
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.18
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.19
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.20
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.21
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.22
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.23
 before 0.4.34-r0
0.4.34-r0
gegl
Alpine:v3.24
 before 0.4.34-r0
0.4.34-r0
Show 63 moreShow less
Affected packages
PackageAffectedFixed
gegl04
AlmaLinux:8
 before 0.4.4-6.el8_5.2
0.4.4-6.el8_5.2
gegl04-devel
AlmaLinux:8
 before 0.4.4-6.el8_5.2
0.4.4-6.el8_5.2
gegl
TuxCare:Ubuntu:18.04
 before 0.3.30-1ubuntu1+tuxcare.els1
0.3.30-1ubuntu1+tuxcare.els1
gir1.2-gegl-0.3
TuxCare:Ubuntu:18.04
 before 0.3.30-1ubuntu1+tuxcare.els1
0.3.30-1ubuntu1+tuxcare.els1
libgegl-0.3-0
TuxCare:Ubuntu:18.04
 before 0.3.30-1ubuntu1+tuxcare.els1
0.3.30-1ubuntu1+tuxcare.els1
libgegl-dev
TuxCare:Ubuntu:18.04
 before 0.3.30-1ubuntu1+tuxcare.els1
0.3.30-1ubuntu1+tuxcare.els1
libgegl-doc
TuxCare:Ubuntu:18.04
 before 0.3.30-1ubuntu1+tuxcare.els1
0.3.30-1ubuntu1+tuxcare.els1
gegl
Debian:12
 before 1:0.4.34-1
1:0.4.34-1
gegl
Debian:13
 before 1:0.4.34-1
1:0.4.34-1
gegl
Debian:14
 before 1:0.4.34-1
1:0.4.34-1
gegl
Debian:11
From an advisory covering 2 CVEs
 before 1:0.4.26-2+deb11u1, plus listed versions
1:0.4.26-2
1:0.4.26-2+deb11u1
gegl
Mageia:8
 before 0.4.34-1.mga8
0.4.34-1.mga8
gimp
openEuler:20.03-LTS-SP1
 before 2.10.6-10.oe1
2.10.6-10.oe1
gimp
openEuler:20.03-LTS-SP2
 before 2.10.6-9.oe1
2.10.6-9.oe1
gimp
openEuler:20.03-LTS-SP3
 before 2.10.6-9.oe1
2.10.6-9.oe1
gegl
Red Hat:enterprise_linux:7::client
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl-devel
Red Hat:enterprise_linux:7::client
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl
Red Hat:enterprise_linux:7::server
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl-devel
Red Hat:enterprise_linux:7::server
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.0-19.el7_9.1
0:0.2.0-19.el7_9.1
gegl04
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04-devel
Red Hat:enterprise_linux:8::crb
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04-tools-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl04
Red Hat:rhel_eus:8.4::appstream
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04-debuginfo
Red Hat:rhel_eus:8.4::appstream
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04-debugsource
Red Hat:rhel_eus:8.4::appstream
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04-tools-debuginfo
Red Hat:rhel_eus:8.4::appstream
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04-debuginfo
Red Hat:rhel_eus:8.4::crb
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04-debugsource
Red Hat:rhel_eus:8.4::crb
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04-devel
Red Hat:rhel_eus:8.4::crb
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04-tools-debuginfo
Red Hat:rhel_eus:8.4::crb
 before 0:0.4.4-6.el8_4.1
0:0.4.4-6.el8_4.1
gegl04
Red Hat:rhel_eus:8.2::appstream
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04-debugsource
Red Hat:rhel_eus:8.2::appstream
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04-tools-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04-debuginfo
Red Hat:rhel_eus:8.2::crb
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04-debugsource
Red Hat:rhel_eus:8.2::crb
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04-devel
Red Hat:rhel_eus:8.2::crb
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04-tools-debuginfo
Red Hat:rhel_eus:8.2::crb
 before 0:0.4.4-6.el8_2.1
0:0.4.4-6.el8_2.1
gegl04
Rocky Linux:8
 before 0:0.4.4-6.el8_5.2
0:0.4.4-6.el8_5.2
gegl
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.2.0-15.6.1
0.2.0-15.6.1
gegl
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 0.2.0-15.6.1
0.2.0-15.6.1
gegl
SUSE:Linux Enterprise Module for Package Hub 15 SP3
 before 0.4.16-3.3.1
0.4.16-3.3.1
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP2
 before 0.4.16-3.3.1
0.4.16-3.3.1
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP3
 before 0.4.16-3.3.1
0.4.16-3.3.1
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP2
 before 0.3.34-3.3.1
0.3.34-3.3.1
gegl
SUSE:Linux Enterprise Workstation Extension 15 SP3
 before 0.3.34-3.3.1
0.3.34-3.3.1
gegl
Ubuntu:Pro:14.04:LTS
 before 0.2.0-4ubuntu1+esm1, plus listed versions
0.2.0-3ubuntu10.2.0-4ubuntu1
0.2.0-4ubuntu1+esm1
gegl
Ubuntu:Pro:16.04:LTS
 before 0.3.4-1ubuntu2+esm1, plus listed versions
0.3.0-4ubuntu20.3.2-1ubuntu10.3.2-1ubuntu20.3.4-1ubuntu10.3.4-1ubuntu2
0.3.4-1ubuntu2+esm1
gegl
Ubuntu:Pro:18.04:LTS
 before 0.3.30-1ubuntu1+esm1, plus listed versions
0.3.20-10.3.20-30.3.24-10.3.28-30.3.30-10.3.30-1ubuntu1
0.3.30-1ubuntu1+esm1
gegl
Ubuntu:Pro:20.04:LTS
 before 0.4.22-3ubuntu0.1~esm1, plus listed versions
0.4.14-10.4.18-1ubuntu10.4.18-20.4.18-2build10.4.22-10.4.22-3
0.4.22-3ubuntu0.1~esm1
gegl
Ubuntu:22.04:LTS
 before 1:0.4.34-1, plus listed versions
1:0.4.32-11:0.4.32-2
1:0.4.34-1
gegl
openSUSE:Leap 15.3
 before 0.4.16-3.3.1
0.4.16-3.3.1
gegl
openSUSE:Leap 15.3
 before 0.3.34-3.3.1
0.3.34-3.3.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-45463 is a high vulnerability (CVSS 7.8) in Gegl, published December 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in gegl 0.4.34-r0.

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open