CVE-2026-114111: Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to code execution?
Deployments using sharp versions before 0.35.5 on glibc-based Linux are potentially exposed, but exploitation depends on runtime-specific conditions. The issue is triggered when sharp decodes an attacker-crafted SVG through librsvg.
What must an attacker be able to do to exploit this issue?
An attacker needs to supply a crafted SVG image that the application passes to sharp for decoding. The provided information does not establish exploitation through image formats other than SVG.
What is the immediate mitigation if upgrading is not possible?
Do not decode SVG files from untrusted sources with sharp until an upgrade is possible. Restricting SVG inputs prevents the described trigger path.