tocsin

crates.io/librsvg CVE-2026-96889: high 7.8

Use-after-free when XML includes have duplicated entities

Action: Upgrade librsvg to 2.57.5 or later.

cargo update -p librsvg --precise 2.57.5
cargo update -p librsvg --precise 2.60.3
cargo update -p librsvg --precise 2.61.5
cargo update -p librsvg --precise 2.62.4
cargo update -p librsvg --precise 2.63.2

Affected

introducedfixedlast affected
0.0.0-02.57.5-
2.57.902.60.3-
2.61.02.61.5-
2.61.902.62.4-
2.62.902.63.2-

Fixed versions

2.57.52.60.32.61.52.62.42.63.2

Sources

CVE-2026-96889 · published · modified · JSON