chai2010/webp v1.1.1 bundles libwebp 1.0.2 (CVE-2023-4863)

go.mod pins github.com/chai2010/webp v1.1.1, which compiles libwebp 1.0.2 from bundled C source (internal/libwebp-1.0.2). That predates the 1.3.2 fix for CVE-2023-4863, a heap overflow in the WebP lossless decoder (BuildHuffmanTable).

utils/image.go NewImage(url) does http.Get(url) on a caller-supplied URL and then image.Decode(res.Body). chai2010/webp's init() registers the WebP decoder via image.RegisterFormat, so a response whose magic bytes are RIFF....WEBP is dispatched to the bundled libwebp regardless of the URL extension. A crafted lossless WebP fetched this way reaches the decoder on the server.

Fix: bump the dependency to a release that ships fixed libwebp, then tidy:

go get github.com/chai2010/[email protected]
go mod tidy

chai2010/webp v1.4.0 bundles libwebp 1.4.0.