cargo package report

Is webp safe?

2 known vulnerabilities, worst severity HIGH.

cvss

8.8

how bad it is if exploited, out of 10

epss

100.0%

chance of exploitation in the next 30 days

xyz score

3.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-j7hp-h8jx-5ppr, the advisory selected below

// advisories

GHSA-j7hp-h8jx-5ppr

HIGHCVE-2023-4863

[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild.

Affected: >=0.0.0-0, <0.9.3
Fixed in: 0.2.6
Weakness: CWE-787
Published: 2023-09-12
Source: github

GHSA NVD MITRE

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so cargo packages are not covered.

Checked 2026-09-22 at 00:39 UTC. The most recent advisory here was published 2025-08-29. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is webp safe? cargo package security report | CyberXYZ