GHSA-94vc-p8w7-5p49
Bundled libwebp in imagecodecs vulnerable
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.
What each source reports
GitHub AdvisoriesNo score
Bundled libwebp in imagecodecs vulnerable
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.
- Record
GHSA-94vc-p8w7-5p49- Updated
- 2026-11-02
OSVNo score
Bundled libwebp in imagecodecs vulnerable
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.
- Record
GHSA-94vc-p8w7-5p49- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagecodecsPyPI | before 2023.9.18 | 2023.9.18 |
imagecodecsPyPI | before 2023.9.18, plus listed versions 2018.10.102018.10.182018.10.222018.10.282018.10.30 Show 41 moreShow less2018.11.82018.12.12018.12.122018.12.162019.1.12019.1.142019.11.182019.11.282019.11.52019.12.312019.2.22019.2.202019.2.222019.4.202020.1.312020.12.242020.2.182020.5.302021.1.112021.1.282021.11.112021.11.202021.2.262021.3.312021.4.282021.6.82021.7.302021.8.262022.12.222022.12.242022.2.222022.7.272022.7.312022.8.82022.9.262023.1.232023.3.162023.7.102023.7.42023.8.122023.9.4 | 2023.9.18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-94vc-p8w7-5p49 is a vulnerability with no CVSS score yet in imagecodecs, published October 5, 2023. No source lists public exploit code. Fixed in imagecodecs 2023.9.18.