Medium

Arbitrary Code Injection in mobile-icon-resizer

Disclosed: 27.06.2019
Updated: 11.10.2026 10:22

mobile-icon-resizer resizes large images for use as icons for iOS and Android.

mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3.

mobile-icon-resizer takes an options object as an argument to define the resulting icons as such:

var options = {
  config: './config.js'
}
resize(options, function(err){});

config.js would need to be a file on the filesystem and look something like:

var config = {
  iOS: {
    "images": [
     /* iOS image definitions are not vulnerable */
    ]
  },
  android: {
    "images" : [
      {
        "baseRatio" : "console.log('Executing script as baseRatio property')",
        "folder" : "drawable-ldpi"
      },
      {
        "ratio" : "console.log('Executing script as ratio property')",
        "folder" : "drawable-mdpi"
      },
    /* other android image defintiions ... */
    ]
  }
};

exports = module.exports = config;

The parameters ratio and baseRatio are passed directly to eval(), thus allowing dynamic javascript payloads to be executed.

Recommendation

Update to version 0.4.3 or later.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	mobile-icon-resizer	>= 0.2.0, < 0.4.3	0.4.3

References

CVSS score 6.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-94
Platform: npm
Package: mobile-icon-resizer
Disclosed: 27.06.2019
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mxjr-xmcg-fg7w - CC BY 4.0

Vulnerability history: mobile-icon-resizer

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

This is the only known vulnerability of this package.

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application