{"id":"GHSA-wq5f-xc86-pv6w","revision":"07f7d7e75515493990e05337a8817e39","records":[{"revision":"07f7d7e75515493990e05337a8817e39","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wq5f-xc86-pv6w","aliases":["CVE-2026-114111"],"title":"sharp : Vulnerability in librsvg dependency CVE-2026-96889","description":"### Impact\n\nA memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.\n\n#### Using a globally-installed librsvg?\n\nPlease ensure you are using the latest librsvg 2.63.2.\n\n### Workarounds\n\nAdd the following to your code to prevent sharp from decoding SVG images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadSvg\"] });\n```\n\nTo avoid RCE, ensure you are using a `node` executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the \"official\" Node.js binaries do not.\n1","state":0,"publishedAt":"2026-10-06T13:43:57+00:00","modifiedAt":"2026-10-21T10:57:27.4416387+00:00","affected":[{"ecosystem":"npm","name":"sharp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.35.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w","https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236","https://github.com/lovell/sharp","https://github.com/lovell/sharp/releases/tag/v0.35.5","https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241","https://www.cve.org/CVERecord?id=CVE-2026-96889"],"sourceUrl":"https://github.com/advisories/GHSA-wq5f-xc86-pv6w","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wq5f-xc86-pv6w","identifiers":["GHSA-wq5f-xc86-pv6w","CVE-2026-114111"]},"retained":false,"historicalAffected":[]}],"coverage":[]}