crates.io/librsvg CVE-2026-96889: high 7.8
Librsvg: Use-after-free when XML includes have duplicated entities
Action: Upgrade librsvg to 2.57.5 or later.
cargo update -p librsvg --precise 2.57.5cargo update -p librsvg --precise 2.60.3cargo update -p librsvg --precise 2.61.5cargo update -p librsvg --precise 2.62.4cargo update -p librsvg --precise 2.63.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.57.5 | - |
| 2.60.0-beta.0 | 2.60.3 | - |
| 2.61.0 | 2.61.5 | - |
| 2.62.0-beta.0 | 2.62.4 | - |
| 2.63.0-beta.0 | 2.63.2 | - |
Fixed versions
| 2.57.5 | 2.60.3 | 2.61.5 | 2.62.4 | 2.63.2 |
Sources
- osv: GHSA-cpvr-w4j5-2mpg
- https://nvd.nist.gov/vuln/detail/CVE-2026-96889
- https://github.com/GNOME/librsvg/commit/0bc935e675947e185d42005d3ad93d7cf61bcea9
- https://github.com/GNOME/librsvg/commit/1606574427408baca8203ef723281509a229f9e2
- https://github.com/GNOME/librsvg/commit/4d0051a9dbd038a5fe8461b61486677d88f8736d
- https://github.com/GNOME/librsvg/commit/e56cc8a33a7184eef6e8a720414aee6205a400ad
- https://rustsec.org/advisories/RUSTSEC-2026-0305.html
- https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
- https://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1211
- https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504
- https://gitlab.gnome.org/GNOME/librsvg
- https://github.com/GNOME/librsvg/releases/tag/2.63.2
- https://github.com/GNOME/librsvg/releases/tag/2.62.4
- https://github.com/GNOME/librsvg/releases/tag/2.61.5
- https://github.com/GNOME/librsvg/releases/tag/2.60.3
- https://github.com/GNOME/librsvg/releases/tag/2.57.5
- https://github.com/GNOME/librsvg/blob/2.63.2/NEWS
- https://bugzilla.redhat.com/show_bug.cgi?id=2539279
- https://access.redhat.com/security/cve/CVE-2026-96889
- https://access.redhat.com/errata/RHSA-2026:86921
- https://access.redhat.com/errata/RHSA-2026:86842
- https://access.redhat.com/errata/RHSA-2026:86841
- https://access.redhat.com/errata/RHSA-2026:86331
CVE-2026-96889 · published · modified · JSON