# librsvg (crates.io) vulnerabilities

2 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 2.63.4 (Oct 23, 2026): no advisory affects it
- Newest unaffected release: 2.63.4 (Oct 23, 2026), the latest release
- Weekly downloads: 1,141
- Dependents: 0
- Releases: 52 since 2.56.0 (Jul 21, 2023)
- Registry: https://crates.io/crates/librsvg
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-96889: 2.56.0 to 2.57.3 (2.57.5 is outside it); 2.58.0-beta.0 to 2.60.2 (2.60.3 is outside it); 2.61.0 to 2.61.4 (2.61.5 is outside it); 2.62.0-beta.0 to 2.62.3 (2.62.4 is outside it); 2.63.0-beta.0 to 2.63.1 (2.63.2 is outside it)
- CVE-2015-7558: no published release is affected

## Advisories (2)

### [CVE-2026-96889](https://cve.now/CVE-2026-96889): Librsvg: use-after-free when xml includes have duplicated entities

- Severity: High 7.8
- Published: Sep 23, 2026
- Affected: fixed in 2.57.5; from 2.57.90, fixed in 2.60.3; from 2.61.0, fixed in 2.61.5; from 2.61.90, fixed in 2.62.4; from 2.62.90, fixed in 2.63.2; fixed in 2.57.5; from 2.60.0-beta.0, fixed in 2.60.3; from 2.61.0, fixed in 2.61.5; from 2.62.0-beta.0, fixed in 2.62.4; from 2.63.0-beta.0, fixed in 2.63.2.
- Fixed in 2.57.5 (released Oct 1, 2026, 8 days after disclosure), 2.60.3 (released Sep 28, 2026, 5 days after disclosure), 2.61.5 (released Sep 25, 2026, 2 days after disclosure) and 2 other versions.
- The latest release, 2.63.4, is not affected.

### [CVE-2015-7558](https://cve.now/CVE-2015-7558): librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application…

- Severity: Unrated
- Published: May 20, 2016
- Affected: fixed in 2.40.12.
- Fixed in 2.56.0 (released Jul 21, 2023, 2618 days after disclosure, the advisory names 2.40.12, which was never published).
- The latest release, 2.63.4, is not affected.
- 0% of librsvg downloads in the last 90 days were affected versions (0).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/crates.io/librsvg
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.