{"action":"Upgrade librsvg to 2.57.5 or later.","affected":[{"fixed":"2.57.5","introduced":"0"},{"fixed":"2.60.3","introduced":"2.60.0-beta.0"},{"fixed":"2.61.5","introduced":"2.61.0"},{"fixed":"2.62.4","introduced":"2.62.0-beta.0"},{"fixed":"2.63.2","introduced":"2.63.0-beta.0"}],"component":"librsvg","cve_ids":["CVE-2026-96889"],"ecosystem":"crates.io","exploited":false,"fixed_versions":["2.57.5","2.60.3","2.61.5","2.62.4","2.63.2"],"ghsa_id":"GHSA-cpvr-w4j5-2mpg","id":"tcs_01M5JMCB6EYNN2R4YF6NXWKZXV","modified_at":"2026-10-22T16:10:47.016154710Z","published_at":"2026-10-22T15:52:48Z","references":["https://osv.dev/vulnerability/GHSA-cpvr-w4j5-2mpg","https://nvd.nist.gov/vuln/detail/CVE-2026-96889","https://github.com/GNOME/librsvg/commit/0bc935e675947e185d42005d3ad93d7cf61bcea9","https://github.com/GNOME/librsvg/commit/1606574427408baca8203ef723281509a229f9e2","https://github.com/GNOME/librsvg/commit/4d0051a9dbd038a5fe8461b61486677d88f8736d","https://github.com/GNOME/librsvg/commit/e56cc8a33a7184eef6e8a720414aee6205a400ad","https://rustsec.org/advisories/RUSTSEC-2026-0305.html","https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241","https://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1211","https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504","https://gitlab.gnome.org/GNOME/librsvg","https://github.com/GNOME/librsvg/releases/tag/2.63.2","https://github.com/GNOME/librsvg/releases/tag/2.62.4","https://github.com/GNOME/librsvg/releases/tag/2.61.5","https://github.com/GNOME/librsvg/releases/tag/2.60.3","https://github.com/GNOME/librsvg/releases/tag/2.57.5","https://github.com/GNOME/librsvg/blob/2.63.2/NEWS","https://bugzilla.redhat.com/show_bug.cgi?id=2539279","https://access.redhat.com/security/cve/CVE-2026-96889","https://access.redhat.com/errata/RHSA-2026:86921","https://access.redhat.com/errata/RHSA-2026:86842","https://access.redhat.com/errata/RHSA-2026:86841","https://access.redhat.com/errata/RHSA-2026:86331"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-cpvr-w4j5-2mpg","url":"https://osv.dev/vulnerability/GHSA-cpvr-w4j5-2mpg"}],"summary":"Librsvg: Use-after-free when XML includes have duplicated entities"}