# sharp memory corruption in librsvg dependency

Source: https://junglewise.ai/threats/sharp-vulnerability-in-librsvg-dependency-b5d03f31  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

Severity: high · Published 2026-10-06

Sharp is a Node.js image processing library that relies on the librsvg dependency to handle SVG image decoding. A memory-related vulnerability in librsvg can allow remote code execution on Linux systems when processing malicious SVG files. Applications using sharp to process untrusted SVG images are at risk of complete system compromise.

Technologies: [Lovell Sharp](https://junglewise.ai/threats/technologies/lovell-sharp), [Sharp](https://junglewise.ai/threats/technologies/npm-sharp). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Lovell](https://junglewise.ai/threats/vendors/lovell).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, published 6 October 2026.

**Which products and versions are affected?** Gnome Librsvg < 2.63.2; Lovell Sharp < 0.35.5; Sharp < 0.35.5.

**Is there a fix for This vulnerability?** Yes: fixed in sharp 0.35.5; librsvg 2.63.2. Until then: Block SVG decoding in sharp by adding `sharp.block({ operation: ["VipsForeignLoadSvg"] });` to prevent processing of SVG images. Alternatively, ensure the Node.js executable is compiled as a Position Independent Executable (PIE); most Linux distributions provide this by default, but official Node.js binaries may not. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access.

**Am I affected?** Check whether you run Gnome Librsvg, Lovell Sharp or Sharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in sharp 0.35.5; librsvg 2.63.2

Block SVG decoding in sharp by adding `sharp.block({ operation: ["VipsForeignLoadSvg"] });` to prevent processing of SVG images. Alternatively, ensure the Node.js executable is compiled as a Position Independent Executable (PIE); most Linux distributions provide this by default, but official Node.js binaries may not.

## Technical details

A use-after-free or memory corruption vulnerability exists in librsvg (CWE-416, CWE-1395) that can lead to RCE under specific runtime conditions on glibc-based Linux systems. The vulnerability is triggered when sharp processes SVG images, and exploitation requires the Node.js executable to lack Position Independent Executable (PIE) hardening. The vulnerability is fixed in sharp 0.35.5 (which bundles librsvg 2.63.2) and librsvg 2.63.2.

## Affected products

- lovell sharp < 0.35.5
- GNOME librsvg < 2.63.2

## Timeline

- 2026-09-30: advisory
- 2026-09-30: patched

## References

- [https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)

## Related threats

- [Sharp image processing library bundled vulnerable libvips](https://junglewise.ai/threats/cve-2026-114113-sharp-before-0-35-0-bundles-a-version-of-libvips-affected-by)
- [Sharp remote code execution in bundled libheif](https://junglewise.ai/threats/cve-2026-114112-sharp-before-0-35-4-bundles-a-vulnerable-libheif-dependency-that)
- [sharp memory-related vulnerability in librsvg dependency](https://junglewise.ai/threats/cve-2026-114111-sharp-before-0-35-5-bundles-a-librsvg-dependency-affected-by-a)
- [librsvg use-after-free in XML entity parsing](https://junglewise.ai/threats/cve-2026-96889-a-flaw-was-found-in-librsvg-when-processing-an-svg-document)
- [sharp remote code execution via malformed HEIF image](https://junglewise.ai/threats/sharp-remote-code-execution-via-malformed-heif-image-32a48ae6)