openSUSE:Factory/dssim embeds libwebp-sys2, which links against an embedded version of libwebp that is vulnerable.