CVE-2022-41704: Apache XML Graphics Batik vulnerable to code execution via SVG.

October 25, 2022 (updated June 14, 2023)

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

References

github.com/advisories/GHSA-r29w-r9ph-vm76
github.com/apache/xmlgraphics-batik/commit/905f368b50c2567cf2c4869a0ab596a7b1b5125c
issues.apache.org/jira/browse/BATIK-1338
lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf
nvd.nist.gov/vuln/detail/CVE-2022-41704
xmlgraphics.apache.org/security.html

Detect and mitigate CVE-2022-41704 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →