librsvg Use-After-Free via Duplicate XML Entities in Nested XInclude (VectorFreed)

#!/usr/bin/env bash
# check_cve_2026_96889.sh — Detect CVE-2026-96889 (librsvg UAF)
# Usage: bash check_cve_2026_96889.sh [/path/to/nodejs/project]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
VULNERABLE=0
CHECKED=0

version_lt() {
  # Returns 0 if $1 < $2 (semver-ish)
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

# --- Check system librsvg ---
echo "[*] Checking system librsvg..."
RSVG_VER=""
if command -v rsvg-convert &>/dev/null; then
  RSVG_VER=$(rsvg-convert --version 2>/dev/null | grep -oP '\d+\.\d+\.\d+' | head -1 || true)
elif command -v dpkg &>/dev/null; then
  RSVG_VER=$(dpkg -l 'librsvg2*' 2>/dev/null | awk '/^ii/{print $3}' | grep -oP '\d+\.\d+\.\d+' | head -1 || true)
elif command -v rpm &>/dev/null; then
  RSVG_VER=$(rpm -q librsvg2 2>/dev/null | grep -oP '\d+\.\d+\.\d+' | head -1 || true)
fi

if [ -n "$RSVG_VER" ]; then
  CHECKED=1
  if version_lt "$RSVG_VER" "2.63.2"; then
    echo -e "${RED}[!] VULNERABLE: system librsvg $RSVG_VER < 2.63.2${NC}"
    VULNERABLE=1
  else
    echo -e "${GREEN}[+] PATCHED: system librsvg $RSVG_VER >= 2.63.2${NC}"
  fi
else
  echo "[*] No system librsvg detected (or not installed)."
fi

# --- Check Node.js sharp dependency ---
PROJECT_DIR="${1:-}"
if [ -n "$PROJECT_DIR" ] && [ -d "$PROJECT_DIR" ]; then
  echo "[*] Checking sharp in $PROJECT_DIR..."
  SHARP_PKG="$PROJECT_DIR/node_modules/sharp/package.json"
  if [ -f "$SHARP_PKG" ]; then
    CHECKED=1
    SHARP_VER=$(grep -oP '"version"\s*:\s*"\K[^"]+' "$SHARP_PKG" 2>/dev/null || true)
    if [ -n "$SHARP_VER" ]; then
      if version_lt "$SHARP_VER" "0.35.5"; then
        echo -e "${RED}[!] VULNERABLE: sharp $SHARP_VER < 0.35.5${NC}"
        VULNERABLE=1
        # Also check if Next.js is present
        NEXT_PKG="$PROJECT_DIR/node_modules/next/package.json"
        if [ -f "$NEXT_PKG" ]; then
          NEXT_VER=$(grep -oP '"version"\s*:\s*"\K[^"]+' "$NEXT_PKG" 2>/dev/null || true)
          echo -e "${RED}    Next.js $NEXT_VER detected — /_next/image is an unauth RCE vector${NC}"
        fi
      else
        echo -e "${GREEN}[+] PATCHED: sharp $SHARP_VER >= 0.35.5${NC}"
      fi
    fi
  else
    echo "[*] sharp not found in $PROJECT_DIR/node_modules/"
  fi

  # Check libc type (glibc vs musl)
  echo "[*] Checking libc type..."
  if ldd --version 2>&1 | grep -qi musl; then
    echo -e "${GREEN}[+] musl libc detected — RCE exploitation is not feasible (DoS only)${NC}"
  elif ldd --version 2>&1 | grep -qi glibc; then
    GLIBC_VER=$(ldd --version 2>&1 | head -1 | grep -oP '\d+\.\d+' | tail -1 || true)
    echo -e "${YELLOW}[!] glibc $GLIBC_VER detected — RCE exploitation IS feasible${NC}"
  fi
else
  [ -n "$PROJECT_DIR" ] && echo "[*] Directory $PROJECT_DIR not found."
fi

# --- Verdict ---
echo ""
if [ "$CHECKED" -eq 0 ]; then
  echo -e "${YELLOW}UNKNOWN — neither librsvg nor sharp detected on this host${NC}"
  exit 2
elif [ "$VULNERABLE" -eq 1 ]; then
  echo -e "${RED}VULNERABLE — CVE-2026-96889 affects this host${NC}"
  exit 1
else
  echo -e "${GREEN}PATCHED — no vulnerable librsvg/sharp versions found${NC}"
  exit 0
fi