Threat database

Sharp versions before 0.35.0 include a bundled libvips library with multiple vulnerabilities affecting GIF, TIFF, and VIPS image decoders. These vulnerabilities allow attackers to supply crafted image files to applications using sharp, potentially triggering the underlying libvips flaws. The issue is resolved in sharp 0.35.0 and later.

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

A use-after-free vulnerability exists in the sharp library before version 0.35.5 due to a vulnerable librsvg dependency (CVE-2026-96889). This flaw can be triggered by processing a crafted SVG image, potentially leading to arbitrary code execution on glibc-based Linux systems. The vulnerability has a high severity score of 8.9 and affects versions of sharp from the initial release up to but not including 0.35.5.