Log in Start free

Vulnerability · Published Aug 5, 2025 · Assigned by GitHub_M

CVE-2025-54387IPX is Vulnerable to Path Traversal via Prefix Matching Bypass

Medium 6.9

In plain English

A medium-severity path traversal in ipx from unjs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.8%top 43.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. This is fixed in versions 1.3.2, 2.1.1 and 3.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmipx1.3.2GHSA-mm3p-j368-7jcr
npmipx2.1.1GHSA-mm3p-j368-7jcr
npmipx3.1.1GHSA-mm3p-j368-7jcr

Affected products (as reported)

VendorProductVersions
unjs ipx < 1.3.2>= 2.0.0-0, < 2.1.1>= 3.0.0, < 3.1.1

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N

References