{"schema":"threatline.record/2","record":{"id":"GHSA-qq8x-fq3x-43h4","aliases":["GHSA-qq8x-fq3x-43h4"],"summary":"Code Injection in MVG encoder when specifying drawing options","details":"When an attacker can supply specifiy drawing options they can use the MVG encoder to perform code injection.","categories":["Libraries & packages"],"product":"ImageMagick","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4","source_modified_at":"2026-10-10T14:00:33Z","fetched_at":"2026-10-27T04:51:10.072820Z","package":{"ecosystem":"c/c++","name":"ImageMagick"},"range":"< 7.1.2-33"},{"source":"GitHub Advisory Database","source_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4","source_modified_at":"2026-10-10T14:00:33Z","fetched_at":"2026-10-27T04:51:10.072820Z","package":{"ecosystem":"c/c++","name":"ImageMagick"},"range":"< 6.9.13-58"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4","source_modified_at":"2026-10-10T14:00:33Z","fetched_at":"2026-10-27T04:51:10.072820Z","package":{"ecosystem":"c/c++","name":"ImageMagick"},"version":"7.1.2-33"},{"source":"GitHub Advisory Database","source_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4","source_modified_at":"2026-10-10T14:00:33Z","fetched_at":"2026-10-27T04:51:10.072820Z","package":{"ecosystem":"c/c++","name":"ImageMagick"},"version":"6.9.13-58"}],"cvss":3.6,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-10T14:00:33Z","modified_at":"2026-10-10T14:00:33Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4","fetched_at":"2026-10-27T04:51:10.072820Z","source_modified_at":"2026-10-10T14:00:33Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-10T14:00:33Z","content_hash":"b48c7fc08ae798f18357087ec8998ae3bd8d7f4eaa1234af1d172f7fa3396c36"}}