Sharp Bundled Dependency Code Execution Flaws

Code execution can be triggered in applications that use sharp before 0.35.4 on glibc-based Linux to decode untrusted AVIF or HEIF images, because the bundled libheif dependency contains heap buffer overflow flaws (CWE-122). The CVE record rates this 8.9 under CVSS 4.0 with a local vector and PR:N, but the independent assessment emphasizes that exploitation requires sharp's VipsForeignLoadHeif path to process attacker-controlled image data and is substantially easier when the Node.js executable is not compiled as PIE; non-glibc deployments and PIE builds reduce exposure. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.

Code execution can occur in sharp versions before 0.35.5 when an application decodes attacker-supplied SVG images through the bundled librsvg, which contains the use-after-free tracked as CVE-2026-96889. The RCE outcome is constrained to glibc-based Linux and Node.js executables that are not built as PIE, so many distribution-packaged Node.js deployments are protected from code execution even though the underlying memory corruption remains. No public exploit was identified at time of analysis; SVG decoding can be disabled with sharp.block as a workaround.

Image decoding through the sharp npm library before 0.35.0 - or through a system libvips older than 8.18.3 - exposes the GIF, TIFF and VIPS loaders to five inherited libvips decoder flaws (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242), two of which are rated High under CVSSv4. An attacker who can get crafted images into an affected application can trigger those decoder bugs with no victim interaction; the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) treats the path as remotely reachable and unauthenticated, so real exposure depends on whether the application accepts untrusted uploads. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to sharp 0.35.0/0.35.3 or blocking the three loaders removes the vulnerable path.