GHSA-rwqr-m72q-v6cm

Untrusted code execution in Apache XML Graphics Batik

At a glance

Published: 2022-10-25 19:00 UTC
Updated: 2025-09-24 21:26 UTC
CVE: CVE-2022-42890
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Affected packages

Package	Versions
Maven · org.apache.xmlgraphics:batik	introduced 0, fixed 1.16
Maven · org.apache.xmlgraphics:batik-bridge	introduced 0, fixed 1.16

References

https://nvd.nist.gov/vuln/detail/CVE-2022-42890 ADVISORY
https://github.com/apache/xmlgraphics-batik/commit/401aa8595f52d085d40ff5b6b4ac0dd372423082 WEB
https://github.com/apache/xmlgraphics-batik/commit/52f7a1ad6e3110ec295a35ffc94410eef085707a WEB
https://github.com/apache/xmlgraphics-batik/commit/eada57c716a2757579d53017f8b2aeadaad20edd WEB
https://issues.apache.org/jira/browse/BATIK-1345 WEB
https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly WEB
https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html WEB
https://security.gentoo.org/glsa/202401-11 WEB
https://www.debian.org/security/2022/dsa-5264 WEB
https://xmlgraphics.apache.org/security.html WEB
http://svn.apache.org/repos/asf/xmlgraphics/batik/trunk WEB
http://www.openwall.com/lists/oss-security/2022/10/25/3 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database