Live › vulnerability › CVE-2026-114111
Go to dashboardsharp before 0.35.5 ships a bundled librsvg library affected by memory-corruption flaw CVE-2026-96889. A crafted SVG image decoded by sharp can lead to arbitrary code execution on glibc-based Linux under certain runtime conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run: npm ls sharp and check the installed version is below 0.35.5.
0.35.5 or later and reinstall dependenciesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-114111")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.