Security1 hSeptember 25, 2026, 21:37

librsvg and NanoSVG flaws trigger without JavaScript

RustSec disclosed a use-after-free in librsvg (CVE-2026-96889) involving nested XML entities, fixed in 2.63.2 and 2.62.4. NanoSVG (CVE-2026-88366) produces NaN from extreme arc radii, causing undefined behavior and potential denial of service. Neither flaw requires JavaScript.

DEV Community

Open source

librsvg and NanoSVG flaws trigger without JavaScript

CVE-2026-96889 in librsvg: use-after-free with duplicate XML entities
Fixes shipped in librsvg 2.63.2 and 2.62.4 on September 23, 2026
CVE-2026-88366 in NanoSVG: NaN from arc radii enables denial of service
Stripping scripts does not make SVG rendering safe

#Librsvg#NanoSVG

OnePlus flaws let installed apps gain root without permissions

Security

Malicious JavaScript evaded VirusTotal in seven of eight storefront attacks

Security

Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

Software

librsvg and NanoSVG flaws trigger without JavaScript

OnePlus flaws let installed apps gain root without permissions

Malicious JavaScript evaded VirusTotal in seven of eight storefront attacks

Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

Tesla FSD v14.3.9 Bug Triggers False Camera Cleaning Alerts