VDB
GHSA-wq5f-xc86-pv6w
GHSA-wq5f-xc86-pv6w
PUBLISHED
CVSS 9.300000190734863 CRITICAL
sharp : Vulnerability in librsvg dependency CVE-2026-96889
Risk Scores
CVSS 3.1
9.300000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| npm | sharp | 0 |
| chainguard | tileserver-gl-fips | 0 |
| wolfi | tileserver-gl | 0 |
| chainguard | tileserver-gl | 0 |
| chainguard | peerdb-ui | 0 |
Timeline
- Oct 6, 2026 CVE Published
References
- https://github.com/advisories/GHSA-wq5f-xc86-pv6w advisory
- https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w url
- https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236 patch
- https://github.com/lovell/sharp/releases/tag/v0.35.5 url
- https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241 url
- https://www.cve.org/CVERecord?id=CVE-2026-96889 url