{"id":"CVE-2026-40853","kind":"vulnerability","aliases":["CVE-2026-40853"],"related":[],"title":"Apache Batik: unencoded SVG font metadata enables cross-site scripting","description":"A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.","summary":"Apache Batik, a Java library for rendering SVG graphics, does not encode font metadata in its SVGFont handling. An attacker who supplies a crafted SVG file can get script to run in a viewer that renders it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["batik","java","package","svg"],"not_affected_if":["no-svg-rendering","trusted-input-only"],"how_to_check":"- Look for `batik` or `xml-graphics-batik` in your Java dependencies (for example `pom.xml` or `build.gradle`) and note the version.\n- Check whether your application renders user-supplied SVG files that use SVG fonts.","fix":"- Apache XML Graphics Batik: upgrade to `1.20`","status":"open","published_at":"2026-11-11T14:17:40+00:00","first_seen_at":"2026-11-11T14:27:32+00:00","triaged_at":"2026-11-11T14:29:24+00:00","updated_at":"2026-11-11T14:29:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T14:29:24Z","model":"claude-haiku-5-5","output":{"fix":"- Apache XML Graphics Batik: upgrade to `1.20`","reach":"unknown","title":"Apache Batik: unencoded SVG font metadata enables cross-site scripting","impact":"medium","summary":"Apache Batik, a Java library for rendering SVG graphics, does not encode font metadata in its SVGFont handling. An attacker who supplies a crafted SVG file can get script to run in a viewer that renders it.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","batik","svg"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in the context of a rendered SVG page","analyst_note":"Confirm the attack vector and whether SVG font rendering is required to trigger it, using the NVD entry and the Apache Batik security page.","how_to_check":"- Look for `batik` or `xml-graphics-batik` in your Java dependencies (for example `pom.xml` or `build.gradle`) and note the version.\n- Check whether your application renders user-supplied SVG files that use SVG fonts.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-svg-rendering","trusted-input-only"],"who_is_affected":"Applications that embed Apache Batik to render SVG content, especially SVG from users or other untrusted sources, are the ones to look at. Teams that only use Batik offline on trusted files, or do not use it at all, can likely skip it. The sources do not say whether a default configuration is exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000737,"input_tokens":4531,"output_tokens":567,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-40853':14A,17A '1.19':79C '1.20':87C 'affect':73C 'apach':1A,22B,68C,74C 'attack':41B 'batik':2A,18B,23B,69C,77C 'craft':45B 'cross':9A,60C 'cross-sit':8A,59C 'cve':12A,15A 'enabl':7A 'encod':33B 'file':47B 'fix':89C 'font':5A,34B,65C 'get':49B 'graphic':30B,76C 'handl':39B 'issu':72C,91C 'java':19B,25B 'librari':26B 'metadata':6A,35B,66C 'packag':20B 'recommend':82C 'render':28B,57B 'run':52B 'script':11A,50B,62C 'site':10A,61C 'suppli':43B 'svg':4A,21B,29B,46B 'svgfont':38B,70C 'unencod':3A,64C 'upgrad':84C 'user':80C 'version':86C 'via':63C 'viewer':55B 'xml':75C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Apache Batik to render SVG content, especially SVG from users or other untrusted sources, are the ones to look at. Teams that only use Batik offline on trusted files, or do not use it at all, can likely skip it. The sources do not say whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["batik","java","package","svg","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-40853':14A,17A 'apach':1A 'batik':2A 'cross':9A 'cross-sit':8A 'cve':12A,15A 'enabl':7A 'font':5A 'metadata':6A 'script':11A 'site':10A 'svg':4A 'unencod':3A","search_b":"'apach':22B 'attack':41B 'batik':18B,23B 'craft':45B 'encod':33B 'file':47B 'font':34B 'get':49B 'graphic':30B 'handl':39B 'java':19B,25B 'librari':26B 'metadata':35B 'packag':20B 'render':28B,57B 'run':52B 'script':50B 'suppli':43B 'svg':21B,29B,46B 'svgfont':38B 'viewer':55B","search_c":"'1.19':79C '1.20':87C 'affect':73C 'apach':68C,74C 'batik':69C,77C 'cross':60C 'cross-sit':59C 'fix':89C 'font':65C 'graphic':76C 'issu':72C,91C 'metadata':66C 'recommend':82C 'script':62C 'site':61C 'svgfont':70C 'unencod':64C 'upgrad':84C 'user':80C 'version':86C 'via':63C 'xml':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40853","severity":null,"published_at":"2026-11-11T14:17:40+00:00","modified_at":"2026-11-11T14:17:40+00:00","first_seen_at":"2026-11-11T14:27:32+00:00","fetched_at":"2026-11-11T14:27:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}