CVE-2026-89326 · Package
NO FIX YET · SEE WHAT TO DO
Apache XML Graphics Batik does not compare the URL protocol when checking whether an external resource shares an origin with the document. An attacker who can supply an SVG or XML document may be able to get Batik to load resources it should treat as cross-origin.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that embed Apache Batik to render or process SVG or XML documents that may contain external resource references are the ones to check. Systems that never parse untrusted SVG with Batik can likely skip it. The sources do not describe a default configuration or a specific trigger path.
Not affected if batik-not-used, no-untrusted-svg
Who cares batik, java, svg
batik-all or org.apache.xmlgraphics:batik-* in pom.xml or build.gradlemvn dependency:tree | grep batik1.20; the description says versions through 1.19 are affectedOrigin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol
This issue affects Apache XML Graphics Batik: through 1.19.
Users are recommended to upgrade to version 1.20, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.