openSUSE:Factory/zola depends on the libwebp-sys crate, which links against a bundled version of libwebp that is vulnerable.