https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 06:47:05 +0000 https://vulnerability.circl.lu/vuln/ghsa-wq5f-xc86-pv6w <p><strong>Affected:</strong> npm: sharp</p> <p>### Impact</p> <p>A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.</p> <p>### Patches</p> <p>#### Using prebuilt binaries provided by sharp?</p> <p>Most people rely on the prebuilt binaries provided by sharp.</p> <p>Please upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.</p> <p>#### Using a globally-installed librsvg?</p> <p>Please ensure you are using the latest librsvg 2.63.2.</p> <p>### Workarounds</p> <p>Add the following to your code to prevent sharp from decoding SVG images. ```js sharp.block({ operation: [&#34;VipsForeignLoadSvg&#34;] }); ```</p> <p>To avoid RCE, ensure you are using a `node` executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the &#34;official&#34; Node.js binaries do not. 1</p> <p><strong>Affected:</strong> npm: sharp</p> <p>### Impact</p> <p>A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.</p> <p>### Patches</p> <p>#### Using prebuilt binaries provided by sharp?</p> <p>Most people rely on the prebuilt binaries provided by sharp.</p> <p>Please upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.</p> <p>#### Using a globally-installed librsvg?</p> <p>Please ensure you are using the latest librsvg 2.63.2.</p> <p>### Workarounds</p> <p>Add the following to your code to prevent sharp from decoding SVG images. ```js sharp.block({ operation: [&#34;VipsForeignLoadSvg&#34;] }); ```</p> <p>To avoid RCE, ensure you are using a `node` executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the &#34;official&#34; Node.js binaries do not. 1</p> https://vulnerability.circl.lu/vuln/ghsa-wq5f-xc86-pv6w