GHSA-2mhw-8qcg-gr96

Suggest an improvement
Source
https://github.com/advisories/GHSA-2mhw-8qcg-gr96
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-2mhw-8qcg-gr96/GHSA-2mhw-8qcg-gr96.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2mhw-8qcg-gr96
Published
2026-03-19T18:10:25Z
Modified
2026-03-19T18:16:28Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version
Details

Impact

The Linux wheels for skia-python vendor a vulnerable version of libfreetype that is affected by CVE-2025-27363 [1].

The root cause is a chain of unfortunate events:

  1. skia-python builds wheels using pinned pypa/cibuildwheel@2.21.3 [2]

  2. cibuildwheel 2.21.3 in turn pins manylinux container images [3]

  3. In these images, version 2.9.1-9.el8 of RedHat package freetype is preinstalled. This package version is vulnerable and has since been patched in 2.9.1-10.

  4. During the skia-python Linux build, libfreetype is vendored from the system, resulting in skia-python.libs/libfreetype-29a7443c.so.6.16.1

[ To find the provenance of your vendored libfreetype, we extracted the 8-character hash of the original binary file that is added during the build process (29a7443c), and matched it against our database of hashes all historic Red Hat, Debian and Ubuntu releases of freetype. ]

  1. Because freetype is only a transitive dependency of the packages explicitly installed by the build script [4], it is not upgraded to the patched version [4].

  2. As a result, the published wheels embed a vulnerable libfreetype, even though patched packages are available upstream.

This appears to be a broader manylinux ecosystem issue. The base images do not enforce that yum update runs on container start, so preinstalled libraries may remain vulnerable indefinitely.

Patches

In the case of skia-python, the solution is to explicitly install freetype in the build process and rebuild the wheels.

The original report was suggesting the above, but in the current build_Linux.sh script, the patched freetype-devel version 2.9.1-10 gets installed as a dependency. It's just that we need to rebuild the wheel for a new release.

Workarounds

Users must upgrade the wheel package after release.

References

  1. https://nvd.nist.gov/vuln/detail/CVE-2025-27363
  2. https://github.com/kyamagu/skia-python/blob/9ffb045811f9b5508e152302d5b81aadca6edd8d/.github/workflows/ci.yml#L38
  3. https://github.com/pypa/cibuildwheel/blob/v2.21.3/cibuildwheel/resources/pinned_docker_images.cfg
  4. https://github.com/kyamagu/skia-python/blob/9ffb045811f9b5508e152302d5b81aadca6edd8d/scripts/build_Linux.sh#L6
Database specific 
{
    "cwe_ids":  [
        "CWE-1395",
        "CWE-787"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-19T18:10:25Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

PyPI / skia-python

Package

Name
skia-python
View open source insights on deps.dev
Purl
pkg:pypi/skia-python

Affected ranges

Affected versions

144.*
144.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-2mhw-8qcg-gr96/GHSA-2mhw-8qcg-gr96.json"

PyPI / skia-python

Package

Name
skia-python
View open source insights on deps.dev
Purl
pkg:pypi/skia-python

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
144.0.post1

Affected versions

0.*
0.0.3
0.0.4
0.0.5
0.0.6
85.*
85.0
86.*
86.0
86.1
87.*
87.0
87.1
87.2
87.3
87.4
87.5
87.6
87.7
87.8
87.9rc1
87.9
116.*
116.0b2
117.*
117.0b3
119.*
119.0b4
120.*
120.0b5
121.*
121.0b6
124.*
124.0b7
126.*
126.0b8
128.*
128.0b9
130.*
130.0b10
132.*
132.0b11
134.*
134.0b12
136.*
136.0b13
138.*
138.0rc1
138.0
144.*
144.0

Database specific

last_known_affected_version_range 
"<= 138.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-2mhw-8qcg-gr96/GHSA-2mhw-8qcg-gr96.json"