GHSA-wq5f-xc86-pv6w

About vulnerability

Impact

A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.

Patches

Using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.

Using a globally-installed librsvg?

Please ensure you are using the latest librsvg 2.63.2.

Workarounds

Add the following to your code to prevent sharp from decoding SVG images.

sharp.block({ operation: ["VipsForeignLoadSvg"] });

To avoid RCE, ensure you are using a node executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the “official” Node.js binaries do not. 1

Affected product:

@livekit/plugins-krisp-viva-internal , Express , Next.js , Node.js , React , Vue , agents-js , appium , appium-base-driver , appium-base-plugin , appium-execute-driver-plugin , appium-opencv , appium-relaxed-caps-plugin , appium-support , arcjet-js , arcjet-logger , arcjet-skills , astro , astro-expressive-code , astrojs-cloudflare , astrojs-internal-helpers , astrojs-markdoc , astrojs-markdown-remark , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-preact , astrojs-prism , astrojs-solid-js , astrojs-studio , astrojs-svelte , astrojs-tailwind , astrojs-underscore-redirects , astrojs-upgrade , astrojs-vercel , astrojs-vue , babel-plugin-remove-graphql-queries , builder.io-qwik-city , clerk-astro , cloudflare-deploy-helpers , cloudflare-pages-shared , cloudflare-runtime-types , cloudflare-vitest-plugin , create-storybook , create-strapi , create-strapi-app , create-video , create-zephyr-apps , docusaurus , elements , gatsby , gatsby-plugin-compile-es6-packages , gatsby-plugin-fathom , gatsby-plugin-manifest , gatsby-plugin-page-creator , gatsby-plugin-react-helmet , gatsby-plugin-sharp , gatsby-sharp , gatsby-source-contentful , gatsby-source-filesystem , gatsby-source-wordpress , gatsby-transformer-sqip , huggingface-transformers , imagetools , img-sharp-darwin-arm64 , img-sharp-darwin-x64 , img-sharp-freebsd-wasm32 , img-sharp-linux-arm , img-sharp-linux-arm64 , img-sharp-linux-ppc64 , img-sharp-linux-riscv64 , img-sharp-linux-s390x , img-sharp-linux-x64 , img-sharp-linuxmusl-arm64 , img-sharp-linuxmusl-x64 , img-sharp-wasm32 , img-sharp-webcontainers-wasm32 , img-sharp-win32-arm64 , img-sharp-win32-ia32 , img-sharp-win32-x64 , ipx , kit , lancedb , livekit-agents , livekit-agents-plugin-anam , livekit-agents-plugin-anthropic , livekit-agents-plugin-assemblyai , livekit-agents-plugin-azure , livekit-agents-plugin-baseten , livekit-agents-plugin-bey , livekit-agents-plugin-cartesia , livekit-agents-plugin-cerebras , livekit-agents-plugin-deepgram , livekit-agents-plugin-did , livekit-agents-plugin-elevenlabs , livekit-agents-plugin-fishaudio , livekit-agents-plugin-google , livekit-agents-plugin-hume , livekit-agents-plugin-inworld , livekit-agents-plugin-krisp , livekit-agents-plugin-lemonslice , livekit-agents-plugin-liveavatar , livekit-agents-plugin-livekit , livekit-agents-plugin-meta , livekit-agents-plugin-minimax , livekit-agents-plugin-mistral , livekit-agents-plugin-mistralai , livekit-agents-plugin-neuphonic , livekit-agents-plugin-perplexity , livekit-agents-plugin-phonic , livekit-agents-plugin-protoface , livekit-agents-plugin-resemble , livekit-agents-plugin-rime , livekit-agents-plugin-sarvam , livekit-agents-plugin-silero , livekit-agents-plugin-soniox , livekit-agents-plugin-tavus , livekit-agents-plugin-trugen , livekit-agents-plugin-xai , livekit/agents-js , livestore , livestore-utils-dev , livestore-webmesh , lucide , lucide-astro , lucide-icons , lucide-preact , lucide-react-native , lucide-solid , lucide-static , lucide-svelte , lucide-vue , mastra , mastra-blaxel , mastra-cloudflare , mastra-cloudflare-d1 , mastra-docker , mastra-dsql , mastra-express , mastra-fastembed , mastra-lance , mastra-langsmith , mastra-livekit , mastra-slack , miniflare , modern-js-image , modern-js-plugin-polyfill , modern-js-tsconfig , modern.js , mux-mux-player-react , netlify-aws-lambda-compat , netlify-dev , netlify-images , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , npm:gatsby-theme-blog-core , panda , pandacss-mcp , pandacss-types , primitives , qwik , rehype-expressive-code , remotion , remotion-animated-emoji , remotion-animation-utils , remotion-babel-loader , remotion-browser-bundler , remotion-bundler , remotion-captions , remotion-cli , remotion-cloudrun , remotion-codemods , remotion-compositor-darwin-arm64 , remotion-compositor-darwin-x64 , remotion-compositor-linux-arm64-gnu , remotion-compositor-linux-arm64-musl , remotion-compositor-linux-x64-gnu , remotion-compositor-linux-x64-musl , remotion-compositor-win32-x64-msvc , remotion-design , remotion-effects , remotion-elevenlabs , remotion-enable-scss , remotion-eslint-config , remotion-eslint-config-flat , remotion-eslint-plugin , remotion-fonts , remotion-gif , remotion-google-fonts , remotion-gsap , remotion-install-whisper-cpp , remotion-lambda , remotion-lambda-client , remotion-layout-utils , remotion-licensing , remotion-light-leaks , remotion-lottie , remotion-mac-cursors , remotion-maptiler , remotion-mcp , remotion-media , remotion-media-parser , remotion-media-utils , remotion-motion-blur , remotion-noise , remotion-openai-whisper , remotion-paths , remotion-player , remotion-preload , remotion-promo-pages , remotion-renderer , remotion-rive , remotion-rough-notation , remotion-rounded-text-box , remotion-sdk , remotion-serverless , remotion-serverless-client , remotion-sfx , remotion-shapes , remotion-skia , remotion-starburst , remotion-streaming , remotion-studio , remotion-studio-protocol , remotion-studio-server , remotion-studio-shared , remotion-svg-3d-engine , remotion-tailwind , remotion-tailwind-v4 , remotion-three , remotion-timeline-utils , remotion-transitions , remotion-vercel , remotion-video-matting , remotion-web-renderer , remotion-webcodecs , remotion-whisper-web , remotion-whisper-webgpu , remotion-zod-types , remotion-zod-types-v3 , responsive-loader , rollup-plugin-zephyr , rsbuild-image , sb , scalar-astro , scalar-starlight , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-javascript , sentry-nitro , sentry-node-native , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , sharp , solana-accounts , solana-addresses , solana-compat , solana-errors , solana-functional , solana-instruction-plans , solana-keys , solana-kit , solana-nominal-types , solana-offchain-messages , solana-plugin-core , solana-programs , solana-promises , solana-react , solana-rpc , solana-rpc-api , solana-rpc-graphql , solana-rpc-parsed-types , solana-rpc-spec , solana-rpc-subscriptions-channel-websocket , solana-rpc-subscriptions-spec , solana-rpc-transformers , solana-rpc-transport-http , solana-subscribable , solana-sysvars , solana-transaction-confirmation , solana-transaction-introspection , solana-transaction-messages , solana-wallet-account-signer , solana-webcrypto-ed25519-polyfill , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-themes , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-experimental-nextjs-vite , storybook-html-vite , storybook-nextjs , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , theme-ui , transloadit , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , with-zephyr , workers-sdk , zbsearch , zbsearch-docs-index , zbsearch-edge-core , zbsearch-edge-index-builder , zbsearch-highlight , zbsearch-plugin-data-persistence , zbsearch-plugin-docusaurus , zbsearch-plugin-embeddings , zbsearch-plugin-match-highlight , zbsearch-plugin-parsedoc , zbsearch-plugin-pt15 , zbsearch-plugin-qps , zbsearch-plugin-starlight , zbsearch-plugin-vitepress , zbsearch-runtime-cloudflare , zbsearch-searchbox-core , zbsearch-searchbox-react , zbsearch-searchbox-vue , zbsearch-static , zbsearch-stemmers , zbsearch-stopwords , zbsearch-tokenizers , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

sharp @ 0.32.6 (+4624 more)