Cross-Site Scripting Vulnerability in Apache XML Graphics Batik
CVE-2026-40853

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Xml Graphics Batik
Vendor
CVE Published:
11 November 2026

What is CVE-2026-40853?

A Cross-Site Scripting vulnerability exists in Apache XML Graphics Batik, specifically through unencoded font metadata in SVGFont. This flaw can potentially allow attackers to inject malicious scripts, resulting in unauthorized access or manipulation of user data. Users are urged to update to version 1.20 or later, which addresses this issue and enhances overall security.

Affected Version(s)

Apache XML Graphics Batik 0 <= 1.19.0

References

https://lists.apache.org/thread.html/donct9w5lp5rlvl1p7m8...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.