GHSA-rgj7-g3m4-5g8c

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026

Severity: High; worst across findings
CVSS: 8.9; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 151; of 17,781 indexed, latest versions
Container images: 150; deployed by those charts
Fix available: 1 of 1; affected package

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Carried by container images the latest versions of 151 of 17,781 indexed charts deploy, on 150 images.

Affected package	Affected versions	Fixed in	Images
sharpnpm	0.27.2, 0.28.1, 0.29.0, 0.29.2+19 more	0.35.4	150

OSV records: GHSA-rgj7-g3m4-5g8c

Charts affected

151 by stars

Chart

Latest

Affected images

Radar Score

websitewaldo-vision

0.33.0

1 of 2 See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-rgj7-g3m4-5g8c.

Container image	Digest	Package	Fixed in
ghcr.io/waldo-vision/web :v0.3.6	5bbc7647df07	sharp@0.32.0	0.35.4

Open the chart page →

3,474

Container images carrying it

150 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
langgenius/dify-web :1.0.0	d64914ff0d6d	sharp@0.33.5	0.35.4	1
lbenicio/helm-pilot :0.2.5	4594a2632510	sharp@0.34.5	0.35.4	1
library/ghost :6.37.0	1ef2e532ca4d	sharp@0.34.5	0.35.4	1
library/ghost :6.25.1	2654b1e90413	sharp@0.34.5	0.35.4	1
library/ghost :6.41.1	29773d6be407	sharp@0.34.5	0.35.4	1
library/ghost :4.37.0	767230c0f263	sharp@0.29.3	0.35.4	1
library/ghost :6.39.0-alpine	77196da4b0df	sharp@0.34.5	0.35.4	1
library/ghost :5.79.0	83f7bf209844	sharp@0.32.6	0.35.4	1
library/ghost :6.62.0	a7a268bbfb7f	sharp@0.35.3	0.35.4	1
library/ghost :6.22.0-alpine3.23	ac533a6988ee	sharp@0.34.2	0.35.4	1
lobehub/lobe-chat :1.96.9	da0c21fefcd3	sharp@0.33.5	0.35.4	1
markdegroot/unifi-protect-arm64 :latest	d8445f2a0de6	sharp@0.30.7	0.35.4	1
misskey/misskey :12.110.1	e08b7c478093	sharp@0.30.3	0.35.4	1
moreillon/food-manager :latest	e8fd856e593d	sharp@0.29.3	0.35.4	1
neoskop/ixy :2.1.1	25152b474f54	sharp@0.34.5	0.35.4	1
nocodb/nocodb :latest	4b760f0d2547	sharp@0.35.3	0.35.4	1
nocodb/nocodb :0.258.0	6779a4ddedf2	sharp@0.33.5	0.35.4	1
nocodb/nocodb :0.301.5	d9516f0bf546	sharp@0.33.4	0.35.4	1
onyxdotapp/onyx-web-server :latest	30d0adaa0fa0	sharp@0.35.3	0.35.4	1
penpotapp/mcp :2.17.2	84f3f07ead11	sharp@0.35.2	0.35.4	1
prowlercloud/prowler-ui :5.31.1	79ee83c8e702	sharp@0.33.5	0.35.4	1
rahulbhiwagade122/desishowbiz :latest	08490b70998c	sharp@0.33.5	0.35.4	1
rocketchat/ddp-streamer-service :8.6.1	819771c4abe4	sharp@0.33.5	0.35.4	1
sondresjo/garge-app :v1.20.6	91767c10ad0e	sharp@0.35.3	0.35.4	1
sondresjo/nstuning-app :v1.6.10	ffca294f10ba	sharp@0.35.3	0.35.4	1
speckle/speckle-frontend-2 :2.21.3-branch.testing5.219631-2153bef	d4ca6ebf09b9	sharp@0.32.6	0.35.4	1
speckle/speckle-preview-service :2.20.2-branch.testing4.134160-9fad4b2	1f897ca906ea	sharp@0.32.6	0.35.4	1
speckle/speckle-preview-service :2.21.3-branch.testing5.219631-2153bef	52cad5e3293e	sharp@0.32.6	0.35.4	1
speckle/speckle-preview-service :2.17.14-branch.testing.72707.921a5f8	84fc39bca0c8	sharp@0.32.6	0.35.4	1
speckle/speckle-preview-service :2.20.6-branch.testing1.154030-9b09114	8f3c1ea153ba	sharp@0.32.6	0.35.4	1
speckle/speckle-preview-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	c102b087481a	sharp@0.32.6	0.35.4	1
speckle/speckle-preview-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	d3da0a84de98	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.17.14-branch.testing.72707.921a5f8	49d10dcdfb91	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4b6a0750d5aa	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	52f8eabf5cea	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.20.2-branch.testing4.134160-9fad4b2	687f43ab16f3	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	sharp@0.34.3	0.35.4	1
speckle/speckle-server :2.26.3	79f14a2bf931	sharp@0.34.4	0.35.4	1
speckle/speckle-server :2.18.12-branch.testing3.88744-f55b341	89a5872375f9	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.18.11-branch.testing2.88634-335d469	bf6a501b2210	sharp@0.32.6	0.35.4	1
speckle/speckle-server :2.20.6-branch.testing1.154030-9b09114	e8413f57b327	sharp@0.32.6	0.35.4	1
supabase/studio :2026.08.03-sha-022b374	606aca9fdaa7	sharp@0.34.5	0.35.4	1
supabase/studio :latest	94a2a9d2906e	sharp@0.34.5	0.35.4	1
veecode/devportal-admin-ui :0.4.30	c69fd286b489	sharp@0.33.4	0.35.4	1
visualregressiontracker/api :5.0.11	941aeb8c8bf9	sharp@0.32.6	0.35.4	1
wsjbr/duplistatus :1.4.2	5e594f5f09f6	sharp@0.34.5	0.35.4	1
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	sharp@0.34.2	0.35.4	1
ghcr.io/bluesky-social/pds :0.4.204	cbc6e3ea157d	sharp@0.33.5	0.35.4	1
ghcr.io/bulwarkmail/webmail :1.6.0	f0a266506fcf	sharp@0.34.5	0.35.4	1