StackRadar

GHSA-wq5f-xc86-pv6w

High

Advisory

Published 6 Oct 2026In the index since 7 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
173
of 18,035 indexed, latest versions
Container images
173
deployed by those charts
Fix available
1 of 1
affected package

sharp : Vulnerability in librsvg dependency CVE-2026-96889

Carried by container images the latest versions of 173 of 18,035 indexed charts deploy, on 173 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.23.4, 0.27.2, 0.28.1, 0.29.0+18 more0.35.5173
OSV records
GHSA-wq5f-xc86-pv6w

Charts affected

173 by stars
ChartLatestAffected imagesRadar Score
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb2 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

2 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
sharp@0.32.6
0.35.5
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
sharp@0.32.6
0.35.5

Open the chart page →

18,219
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f82 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

2 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
sharp@0.32.6
0.35.5
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
sharp@0.32.6
0.35.5

Open the chart page →

16,239
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091142 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

2 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
sharp@0.32.6
0.35.5
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sharp@0.32.6
0.35.5

Open the chart page →

18,219
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4692 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

2 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
sharp@0.32.6
0.35.5
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sharp@0.32.6
0.35.5

Open the chart page →

15,860
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3412 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

2 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
sharp@0.32.6
0.35.5
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sharp@0.32.6
0.35.5

Open the chart page →

15,860
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b22 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

2 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
sharp@0.32.6
0.35.5
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
sharp@0.32.6
0.35.5

Open the chart page →

17,788
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef3 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

3 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
sharp@0.32.6
0.35.5
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
sharp@0.32.6
0.35.5
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sharp@0.32.6
0.35.5

Open the chart page →

17,473
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
sharp@0.34.3
0.35.5

Open the chart page →

12,592
strapistrapi-xmv0.1.21 of 1See more

strapi strapi-xmv 0.1.2

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latest978cda40de67
sharp@0.33.5
0.35.5

Open the chart page →

957
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
supabase/studio:latestfdb56cfa1705
sharp@0.35.4
0.35.5

Open the chart page →

10,711
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
sharp@0.34.5
0.35.5

Open the chart page →

6,307
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.5
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.5
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.5

Open the chart page →

9,117
altinnendata-apptumogroup0.1.241 of 1See more

altinnendata-app tumogroup 0.1.24

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
sondresjo/altinnendata-app:v1.9.81c850e7bb963
sharp@0.35.4
0.35.5

Open the chart page →

892
nstuning-apptumogroup0.1.231 of 1See more

nstuning-app tumogroup 0.1.23

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
sondresjo/nstuning-app:v1.6.1620805ad01071
sharp@0.35.4
0.35.5

Open the chart page →

892
pyttogpanne-apptumogroup0.1.61 of 1See more

pyttogpanne-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
sondresjo/pyttogpanne-app:v1.0.5e9a8d7e36e71
sharp@0.35.4
0.35.5

Open the chart page →

892
sjolystinnovation-apptumogroup0.1.61 of 1See more

sjolystinnovation-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
sondresjo/sjolystinnovation-app:v1.3.11a315219c9c2
sharp@0.35.4
0.35.5

Open the chart page →

892
evershopunifieVerified publisher1.0.01 of 1See more

evershop unifie 1.0.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
evershop/evershop:latestd0823576f91b
sharp@0.33.5
0.35.5

Open the chart page →

1,329
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
sharp@0.35.3
0.35.5

Open the chart page →

622
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
sharp@0.34.5
0.35.5

Open the chart page →

4,573
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
sharp@0.34.5
0.35.5

Open the chart page →

2,758
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
sharp@0.33.5
0.35.5

Open the chart page →

7,534
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.5

Open the chart page →

4,128
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
sharp@0.33.3
0.35.5

Open the chart page →

1,657

Container images carrying it

173 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sharp@0.32.6
0.35.5
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sharp@0.32.6
0.35.5
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sharp@0.34.5
0.35.5
1
supabase/studio:latestfdb56cfa1705
sharp@0.35.4
0.35.5
1
veecode/devportal-admin-ui:0.4.30c69fd286b489
sharp@0.33.4
0.35.5
1
visualregressiontracker/api:5.0.11941aeb8c8bf9
sharp@0.32.6
0.35.5
1
webodm/webodm_webapp:3.3.0ed7b1aa0e40f
sharp@0.35.4
0.35.5
1
wsjbr/duplistatus:1.5.0bede86cf183f
sharp@0.35.4
0.35.5
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
sharp@0.34.2
0.35.5
1
ghcr.io/akash-network/deploy-web:2.46.0ac540172c120
sharp@0.30.7
0.35.5
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
sharp@0.35.4
0.35.5
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
sharp@0.33.5
0.35.5
1
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
sharp@0.35.4
0.35.5
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
sharp@0.34.5
0.35.5
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
sharp@0.33.5
0.35.5
1
ghcr.io/colanode/server:latest7006cac874fd
sharp@0.34.5
0.35.5
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
sharp@0.33.5
0.35.5
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.5
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.5
1
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.5
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
sharp@0.35.3
0.35.5
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
sharp@0.35.4
0.35.5
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.5
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
sharp@0.35.4
0.35.5
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
sharp@0.34.5
0.35.5
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
sharp@0.35.3
0.35.5
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
sharp@0.34.5
0.35.5
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
sharp@0.34.5
0.35.5
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
sharp@0.34.5
0.35.5
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
sharp@0.34.5
0.35.5
1
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
sharp@0.35.4
0.35.5
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
sharp@0.35.3
0.35.5
1
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
sharp@0.35.3
0.35.5
1
ghcr.io/immich-app/immich-server:v3.2.4d317916b2809
sharp@0.35.3
0.35.5
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
sharp@0.34.4
0.35.5
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
sharp@0.34.5
0.35.5
1
ghcr.io/kagent-dev/kagent/ui:0.10.313f62914b66e
sharp@0.35.4
0.35.5
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.5
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
sharp@0.34.5
0.35.5
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
sharp@0.33.3
0.35.5
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.5
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.5
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.5
1
ghcr.io/microboxlabs/miot-docs:latest84877c693d8a
sharp@0.35.4
0.35.5
1
ghcr.io/microboxlabs/miot-docs:latestb528e6a1d9d5
sharp@0.35.4
0.35.5
1
ghcr.io/multica-ai/multica-web:v0.6.1cc8260b03716
sharp@0.35.4
0.35.5
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.5
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
sharp@0.34.5
0.35.5
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
sharp@0.35.4
0.35.5
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
sharp@0.33.4
0.35.5
1

syft 1.42.1 · advisories as of 7 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.