CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont
Severity: moderate
32
CVE-2026-40853
XSS in Apache Batik SVGFont via unencoded font metadata
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache XML Graphics Batik does not encode font metadata in SVGFont, allowing cross-site scripting (CWE-79). An attacker who supplies a crafted SVG with malicious font metadata can run script in the browser of a user who opens or renders that content. All deployments of Apache Batik through 1.19 are affected.
What to do: Upgrade Apache XML Graphics Batik to 1.20, which fixes unencoded font metadata in SVGFont.
| Product | Affected | Fixed in |
|---|---|---|
| Apache XML Graphics Batik | through 1.19 | 1.20 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
- Weakness
- CWE-79