GHSA-f88m-g3jw-g9cj CVE-2026-114113
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
- Severity
- 7.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.11%
- Chance of exploitation in the next 30 days. Higher than 1.11% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1395 Dependency on Vulnerable Third-Party Component
- Fix
0.35.0- Upgrade sharp to this version or later
Description
Impact
A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.
Those processing untrusted input with versions of sharp prior to 0.35.0 are affected.
Patches
Using prebuilt binaries provided by sharp?
Most people rely on the prebuilt binaries provided by sharp.
Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.
Using a globally-installed libvips?
Please ensure you are using the latest libvips 8.18.3.
Workarounds
Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images.
sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] });
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
sharp npm → 0.35.0
- npm
npm install sharp@0.35.0- yarn
yarn add sharp@0.35.0- pnpm
pnpm add sharp@0.35.0
Severity breakdown
CVSS 4.0 7.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-1395: Dependency on Vulnerable Third-Party Component
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
How to prevent it
- Requirements, Policy: In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.
- Requirements: Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
- Architecture and Design, Implementation, Integration, Manufacturing: Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
- Operation, Patching and Maintenance: Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.
- Operation, Patching and Maintenance: Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.
References
Advisories
- github.com/advisories/GHSA-f88m-g3jw-g9cj
- github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x
- github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76
- github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm
- github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7
- github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-wq5f-xc86-pv6w sharp : Vulnerability in librsvg dependency CVE-2026-96889 | High | Also affects sharp |
| GHSA-rgj7-g3m4-5g8c sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 | High | Also affects sharp |
| GHSA-54xq-cgqr-rpm3 sharp vulnerability in libwebp dependency CVE-2023-4863 | High | Also affects sharp |
| GHSA-gp95-ppv5-3jc5 sharp vulnerable to Command Injection in post-installation over build environment | Medium | Also affects sharp |
| GHSA-78g4-xqwv-q3g8 Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() | High | Same weakness, CWE-1395 |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used | Critical | Same weakness, CWE-1395 |
| GHSA-788w-68h3-cvxp Ghost: Remote Code Execution via Bookmark Card Images | High | Same weakness, CWE-1395 |
| GHSA-vcvr-r3jv-pc5j Next.js: Remote Code Execution in next/og ImageResponse | Critical | Same weakness, CWE-1395 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor