These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A memory-related vulnerability in the librsvg dependency of the sharp library can lead to possible remote code execution (RCE) on glibc-based Linux when certain runtime-specific conditions apply. The vulnerability has been fixed in sharp version 0.35.5, which includes librsvg 2.63.2. Users can upgrade to the latest version of sharp or ensure they are using the latest librsvg 2.63.2 if installed globally. [truncated]
CVE-2026-114112: Vulnerabilities in libheif affect sharp, a popular image processing library for Node.js. The vulnerabilities, two rated as Critical severity using CVSSv3, can lead to possible remote code execution (RCE) on glibc-based Linux systems when processing untrusted input with versions of sharp prior to 0.35.4. Although the attack vector is network-based, sharp does not provide networking feature [truncated]
CVE-2026-114113 debrief: Multiple vulnerabilities in libvips affect sharp users. Upgrade to sharp 0.35.3 or later for patched libvips 8.18.3. This upgrade is crucial as it addresses several high-severity vulnerabilities in libvips, a dependency of sharp. Users processing untrusted input with sharp versions prior to 0.35.0 are at risk. The patched version, 0.35.3, includes libvips 8.18.3, which fixes these [truncated]