CVE-2026-40853 · Package
NO FIX YET · SEE WHAT TO DO
Apache Batik, a Java library for rendering SVG graphics, does not encode font metadata in its SVGFont handling. An attacker who supplies a crafted SVG file can get script to run in a viewer that renders it.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that embed Apache Batik to render SVG content, especially SVG from users or other untrusted sources, are the ones to look at. Teams that only use Batik offline on trusted files, or do not use it at all, can likely skip it. The sources do not say whether a default configuration is exposed.
Not affected if no-svg-rendering, trusted-input-only
Who cares batik, java, svg
batik or xml-graphics-batik in your Java dependencies (for example pom.xml or build.gradle) and note the version.1.20A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.
This issue affects Apache XML Graphics Batik: through 1.19.
Users are recommended to upgrade to version 1.20, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.