CVE-2022-41704

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-41704
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-41704.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-41704
Aliases
Downstream
Related
Published
2022-10-25T00:00:00Z
Modified
2026-05-18T05:55:26.009269429Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
Details

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

Database specific 
{
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "Batik"
                },
                {
                    "last_affected": "1.15"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41704.json"
}
References

Affected packages

Git / github.com/apache/xmlgraphics-batik

Affected ranges

Type
GIT
Repo
https://github.com/apache/xmlgraphics-batik
Events
Introduced
1b708df57205a70c2c9fb8235ff5eab837609968
Fixed
8e94aaaf3872a670040c6faebe82c907cb380fad
Database specific 
{
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "fixed": "1.16"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-41704.json"