CVE-2022-23646

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-23646
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23646.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-23646
Aliases
Published
2022-02-17T20:35:12Z
Modified
2025-12-04T10:16:58.209923Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Improper CSP in Image Optimization API for Next.js
Details

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default.

Database specific 
{
    "cwe_ids": [
        "CWE-451"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23646.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
118ab7992bc8f7a7e5a7bb996510d9b56ffe4f68
Fixed
8545fd1bb02244ced9e8dc9584a764aeae296cd0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23646.json"