high · CVSS v3 7.8 · CVSS v4 8.9

CVE-2026-114111

Sharp image processing library versions prior to 0.35.5 bundle a vulnerable librsvg dependency that can be triggered by a crafted SVG image,

Overview

Sharp image processing library versions prior to 0.35.5 bundle a vulnerable librsvg dependency that can be triggered by a crafted SVG image, leading to arbitrary code execution on glibc-based Linux systems. The flaw originates from memory handling in librsvg and is exposed when Sharp decodes SVG files. This vulnerability is relevant to any Node.js application that processes SVG images on Linux.

Description

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.

Impact

The vulnerability compromises confidentiality, integrity, and availability of affected systems by allowing attackers to execute arbitrary code. Node.js developers, web application administrators, and cloud service providers that use Sharp on Linux are directly impacted. Users of these services may face data breaches, unauthorized system changes, or service disruptions.

Remediation

Upgrade Sharp to version 0.35.5 or later, which removes the vulnerable librsvg bundle. If upgrading is not immediately possible, update the system’s librsvg package to a patched release or disable SVG processing entirely. Additionally, validate and sanitize SVG inputs, run image processing in a sandboxed environment, and monitor for anomalous process activity.

Risk context

The CVE has a high severity rating with CVSS v3 score of 7.8 and CVSS v4 score of 8.9, indicating a significant risk. No EPSS data is available, but the high scores warrant prompt attention. Defenders should treat this as a high-priority issue and act quickly to mitigate.

Affected products

  • Sharp
  • librsvg
  • Node.js
  • Linux glibc
  • npm
  • web apps
  • cloud services
  • Docker containers

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.8
CVSS v4
8.9
EPSS
—

sharp librsvg svg code execution memory corruption nodejs image processing glibc

← All CVEs

Related CVEs

high

CVE-2026-114063

SvelteKit versions 2.10.0 through 2.99.9 expose a path traversal flaw in the Vite preview server on Windows, letting unauthenticated users read arbitrary files outside the prerendered output. The vulnerability can leak source code, configuration, or credentials if the preview server is reachable over the network. It is critical for deployments that expose the preview server to the internet or internal network.

View analysis

high

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

View analysis

high

CVE-2026-114068

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.

View analysis

high

CVE-2026-114069

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.

View analysis