CVE-2026-114111 Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114111?
CVE-2026-114111 is a high-severity vulnerability in lovell sharp, published on 21 Oct 2026.
Official description
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
Weakness: CWE-416
Which versions are affected by CVE-2026-114111?
2 open source packages ship an affected version, including sharp.
| Package | Affected | Fixed in |
|---|---|---|
sharp npm | All versions | 0.35.5 |
sharp npm | All versions | 0.35.5 |
How do I fix CVE-2026-114111?
Upgrade sharp to 0.35.5 or later.
Is CVE-2026-114111 being exploited?
There is no known exploitation of CVE-2026-114111 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-AN86015, CLEANSTART-2026-BZ86310, CLEANSTART-2026-JE80726, CLSA-2026-1791887358, ECHO-6169-5cd8-c8e3, GHSA-j56w-ppx9-7qff and 8 more.