CVE-2026-96889

High

Advisory

Published 23 Sept 2026In the index since 25 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.001; 2nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 206; of 17,844 indexed, latest versions
Container images: 213; deployed by those charts
Fix available: None; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 206 of 17,844 indexed charts deploy, on 213 images.

Affected package	Affected versions	Fixed in	Images
librsvgdeb	2.40.13-3, 2.40.20-2, 2.40.20-2ubuntu0.2, 2.48.9-1ubuntu0.20.04.1+8 more	no fix listed	213

OSV records: DEBIAN-CVE-2026-96889 UBUNTU-CVE-2026-96889

Charts affected

206 by stars

Chart

Latest

Affected images

Radar Score

tfy-distributortruefoundry

0.0.1

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-96889.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed

Open the chart page →

18,032

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-96889.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	librsvg@2.54.5+dfsg-1	no fix listed

Open the chart page →

15,031

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-96889.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed

Open the chart page →

11,423

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-96889.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	librsvg@2.52.5+dfsg-3ubuntu0.2	no fix listed

Open the chart page →

14,813

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-96889.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	1d8f72d2ce20	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed

Open the chart page →

4,800

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-96889.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	librsvg@2.52.5+dfsg-3ubuntu0.2	no fix listed

Open the chart page →

8,360

Container images carrying it

213 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
ghcr.io/zammad/zammad :7.2.0-0000	61a2947b478e	librsvg@2.60.0+dfsg-1	no fix listed	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
public.ecr.aws/g4a0y2u8/unifie-store :staging-19925	a2057fabc948	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1
quay.io/go-skynet/local-ai :latest	0632c21ddbe4	librsvg@2.58.0+dfsg-1build1	no fix listed	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	librsvg@2.54.5+dfsg-1	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	librsvg@2.54.7+dfsg-1~deb12u1	no fix listed	1