Reflected Cross-Site Scripting in Netdata Affecting User Interaction Endpoints

CVE-2025-71385

What is CVE-2025-71385?

Netdata versions prior to 2.3.1 exhibit a reflected cross-site scripting vulnerability on the ilove.svg endpoints. The application fails to properly escape the user-supplied 'love' query parameter, allowing attackers to inject malicious scripts. When a user accesses a crafted URL containing the script, the injected code executes in the victim's browser context. This vulnerability is particularly concerning as the affected endpoints are accessible without authentication, posing serious security risks. To mitigate this issue, users should upgrade to version 2.3.1 or later, where the vulnerable endpoints have been removed.

References