muhammara vulnerable to Unchecked Return Value to NULL Pointer Dereference
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| julianhille | MuhammaraJS | before 2.6.2; 3.0.0 to before 3.4.0 | 2.6.2, 3.4.0 | Patch available | CNA |
| — | hummus (npm) | all versions | — | No fix listed | GHSA-2r7v-cmch-5x26 |
| — | muhammara (npm) | 3.0.0 to before 3.4.0 | 3.4.0 | Patch available | GHSA-2r7v-cmch-5x26 |
| — | muhammara (npm) | before 2.6.2 | 2.6.2 | Patch available | GHSA-2r7v-cmch-5x26 |
- MuhammaraJS Vendorjulianhille Affected before 2.6.2; 3.0.0 to before 3.4.0 Fixed in 2.6.2, 3.4.0 Patch available CNA
- hummus (npm) Vendor— Affected all versions Fixed in — No fix listed GHSA-2r7v-cmch-5x26
- muhammara (npm) Vendor— Affected 3.0.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-2r7v-cmch-5x26
- muhammara (npm) Vendor— Affected before 2.6.2 Fixed in 2.6.2 Patch available GHSA-2r7v-cmch-5x26
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:muhammara_project:muhammara:*:*:*:*:*:node.js:*:* | before 2.6.2; 3.0.0 to before 3.3.0 | Vulnerable | Muhammara Project |
| cpe:2.3:a:hummus_project:hummus:*:*:*:*:*:node.js:*:* | all versions | Vulnerable | Hummus Project |
- cpe:2.3:a:muhammara_project:muhammara:*:*:*:*:*:node.js:*:* Versions before 2.6.2; 3.0.0 to before 3.3.0 Vulnerable ·Muhammara Project
- cpe:2.3:a:hummus_project:hummus:*:*:*:*:*:node.js:*:* Versions all versions Vulnerable ·Hummus Project
Remediation
- Fix · CNA MuhammaraJS (julianhille) Fixed in 2.6.2, 3.4.0
- Fix · GHSA-2r7v-cmch-5x26 muhammara (npm) Fixed in 3.4.0 Advisory →
- Fix · GHSA-2r7v-cmch-5x26 muhammara (npm) Fixed in 2.6.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41957
- 2026-10-03 Alias added: GHSA-2r7v-cmch-5x26
References
Sources
- CVE-2022-41957 · CVE Program
- CVE-2022-41957 · NVD
- FIRST EPSS
- GHSA-2r7v-cmch-5x26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences