{"id":"CVE-2026-70377","published":"2026-08-05T08:16:41.830","lastModified":"2026-08-10T12:17:23.710","description":"imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-789"],"vendors":[],"products":[],"references":[{"url":"https://github.com/theotherphil/imagecli/issues/66","tags":[]},{"url":"https://github.com/theotherphil/imagecli/issues/66","tags":[]}],"exploitRefs":[{"url":"https://github.com/theotherphil/imagecli/issues/66","tags":[]},{"url":"https://github.com/theotherphil/imagecli/issues/66","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows remote code execution by manipulating the ratio parameter in imagecli's pipeline operation without proper validation, leading to potential crashes or arbitrary code execution.","exploitability":"Exploitation requires user-controlled input for the ratio parameter and embedding of imagecli as a library. The exploit is relatively easy given these preconditions.","blast_radius":"If exploited, this could impact any application using imagecli that accepts user input, potentially leading to remote code execution or service disruption.","remediation":"Update to the latest version of imagecli that includes proper validation for the ratio parameter.","tags":["rce","input-validation","library-exploit","remote-code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:58:44.957Z"}}