CVE-2026-114111

About vulnerability

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.

Affected product:

@livekit/plugins-krisp-viva-internal , Next.js , Node.js , React , Vue , agents-js , appium , appium-base-driver , appium-base-plugin , appium-execute-driver-plugin , appium-opencv , appium-relaxed-caps-plugin , appium-support , arcjet-js , astro , astro-expressive-code , astrojs-cloudflare , astrojs-markdoc , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-svelte , astrojs-tailwind , astrojs-vercel , astrojs-vue , babel-plugin-remove-graphql-queries , builder.io-qwik-city , clerk-astro , cloudflare-deploy-helpers , cloudflare-pages-shared , cloudflare-runtime-types , cloudflare-vitest-plugin , docusaurus , elements , gatsby , gatsby-plugin-compile-es6-packages , gatsby-plugin-fathom , gatsby-plugin-manifest , gatsby-plugin-page-creator , gatsby-plugin-react-helmet , gatsby-plugin-sharp , gatsby-sharp , gatsby-source-contentful , gatsby-source-filesystem , gatsby-source-wordpress , gatsby-transformer-sqip , huggingface-transformers , imagetools , img-sharp-darwin-arm64 , img-sharp-darwin-x64 , img-sharp-linux-arm , img-sharp-linux-arm64 , img-sharp-linux-ppc64 , img-sharp-linux-riscv64 , img-sharp-linux-s390x , img-sharp-linux-x64 , img-sharp-win32-arm64 , img-sharp-win32-ia32 , img-sharp-win32-x64 , ipx , kit , lancedb , livekit-agents , livekit-agents-plugin-anam , livekit-agents-plugin-anthropic , livekit-agents-plugin-assemblyai , livekit-agents-plugin-azure , livekit-agents-plugin-baseten , livekit-agents-plugin-bey , livekit-agents-plugin-cartesia , livekit-agents-plugin-cerebras , livekit-agents-plugin-deepgram , livekit-agents-plugin-did , livekit-agents-plugin-elevenlabs , livekit-agents-plugin-fishaudio , livekit-agents-plugin-google , livekit-agents-plugin-hume , livekit-agents-plugin-inworld , livekit-agents-plugin-krisp , livekit-agents-plugin-lemonslice , livekit-agents-plugin-liveavatar , livekit-agents-plugin-livekit , livekit-agents-plugin-meta , livekit-agents-plugin-minimax , livekit-agents-plugin-mistral , livekit-agents-plugin-mistralai , livekit-agents-plugin-neuphonic , livekit-agents-plugin-perplexity , livekit-agents-plugin-phonic , livekit-agents-plugin-protoface , livekit-agents-plugin-resemble , livekit-agents-plugin-rime , livekit-agents-plugin-sarvam , livekit-agents-plugin-silero , livekit-agents-plugin-soniox , livekit-agents-plugin-tavus , livekit-agents-plugin-trugen , livekit-agents-plugin-xai , livekit/agents-js , livestore-utils-dev , lucide-astro , mastra , mastra-lance , mastra-livekit , miniflare , modern-js-image , netlify-dev , netlify-images , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , npm:gatsby-theme-blog-core , panda , qwik , remotion-video-matting , remotion-whisper-webgpu , responsive-loader , rsbuild-image , scalar-astro , scalar-starlight , sentry-gatsby , sharp , storybook-experimental-nextjs-vite , storybook-nextjs , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-strapi , strapi-upload , theme-ui , transloadit , workers-sdk , zbsearch-runtime-cloudflare , zephyr-astro-integration

Affected packages:

sharp @ 0.32.6 (+1461 more)