Repository navigation
chore(stack): pin imgproxy to v3.26.0 - #6726
supabase-cli-releaser[bot] wants to merge 1 commit into
Conversation
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
| "imgproxy", | ||
| "v3.8.0", | ||
| "ghcr.io/supabase/cli/imgproxy:v3.8.0", | ||
| "v3.26.0", |
There was a problem hiding this comment.
🟡 Severity: MEDIUM
The newly pinned imgproxy v3.26.0 is affected by CVE-2025-24354/GHSA-j2hp-6m75-v4j4 (all versions <3.27.2). An attacker controlling an image-source URL sent through Storage/imgproxy can request 0.0.0.0; imgproxy may then reach local services and disclose their responses. GHSA-j2hp-6m75-v4j4
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: Upgrade imgproxy from v3.26.0 to v3.27.2 or later to fix CVE-2025-24354 (SSRF). This requires two coordinated changes: (1) on line 101, change the version string from "v3.26.0" to "v3.27.2"; (2) on line 102, update the image reference to "ghcr.io/supabase/cli/imgproxy:v3.27.2@sha256:<new-digest>", replacing <new-digest> with the actual SHA-256 digest of the v3.27.2 image pulled from ghcr.io/supabase/cli/imgproxy:v3.27.2.
0eee150 to
81d6f23
Compare
81d6f23 to
21325bc
Compare
Pins
packages/stack/src/Artifacts.tsto theimgproxyv3.26.0slim-services release and its image digest.
Opened from the
mirror-slim-imagedispatch.artifactForderives thenative release tag, asset names, and URLs from service + version, so this
pin is the whole change.