{"id":"CVE-2026-89326","kind":"vulnerability","aliases":["CVE-2026-89326"],"related":[],"title":"Apache Batik: same-origin check skips protocol comparison, allowing cross-origin resource loads","description":"Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.","summary":"Apache XML Graphics Batik does not compare the URL protocol when checking whether an external resource shares an origin with the document. An attacker who can supply an SVG or XML document may be able to get Batik to load resources it should treat as cross-origin.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["batik","java","package","svg"],"not_affected_if":["batik-not-used","no-untrusted-svg"],"how_to_check":"- Check the Batik version in your build file or lockfile, e.g. `batik-all` or `org.apache.xmlgraphics:batik-*` in `pom.xml` or `build.gradle`\n- Look for Batik in your dependency tree, e.g. `mvn dependency:tree | grep batik`","fix":"- Apache XML Graphics Batik: upgrade to `1.20`; the description says versions through `1.19` are affected","status":"open","published_at":"2026-11-11T15:17:25+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","triaged_at":"2026-11-11T15:29:53+00:00","updated_at":"2026-11-11T15:29:53+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T15:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apache XML Graphics Batik: upgrade to `1.20`; the description says versions through `1.19` are affected","reach":"unknown","title":"Apache Batik: same-origin check skips protocol comparison, allowing cross-origin resource loads","impact":"low","summary":"Apache XML Graphics Batik does not compare the URL protocol when checking whether an external resource shares an origin with the document. An attacker who can supply an SVG or XML document may be able to get Batik to load resources it should treat as cross-origin.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","batik","svg"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the sources only say the same-origin check is flawed","analyst_note":"Check the Apache Batik security advisory and NVD entry for the exact impact and attack vector; sources give only the one-line description.","how_to_check":"- Check the Batik version in your build file or lockfile, e.g. `batik-all` or `org.apache.xmlgraphics:batik-*` in `pom.xml` or `build.gradle`\n- Look for Batik in your dependency tree, e.g. `mvn dependency:tree | grep batik`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-svg","batik-not-used"],"who_is_affected":"Applications that embed Apache Batik to render or process SVG or XML documents that may contain external resource references are the ones to check. Systems that never parse untrusted SVG with Batik can likely skip it. The sources do not describe a default configuration or a specific trigger path.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000757,"input_tokens":4545,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-89326':18A,21A '1.19':104C '1.20':112C 'abl':60B 'affect':98C 'allow':10A 'apach':1A,26B,79C,99C 'attack':49B 'batik':2A,22B,29B,63B,82C,102C 'check':6A,37B,89C 'compar':32B,92C 'comparison':9A 'cross':12A,72B 'cross-origin':11A,71B 'cve':16A,19A 'document':47B,57B 'error':76C 'extern':40B,84C 'fix':114C 'get':62B 'graphic':28B,81C,101C 'issu':97C,116C 'java':23B 'load':15A,65B 'may':58B 'origin':5A,13A,44B,73B,74C,88C 'packag':24B 'protocol':8A,35B,95C 'recommend':107C 'resourc':14A,41B,66B,85C 'same-origin':3A,86C 'share':42B 'skip':7A 'suppli':52B 'svg':25B,54B 'treat':69B 'upgrad':109C 'url':34B,94C 'user':105C 'valid':75C 'version':111C 'vulner':77C 'whether':38B 'xml':27B,56B,80C,100C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Apache Batik to render or process SVG or XML documents that may contain external resource references are the ones to check. Systems that never parse untrusted SVG with Batik can likely skip it. The sources do not describe a default configuration or a specific trigger path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["batik","java","package","svg","unknown"],"campaign_type":null,"search_a":"'-2026':17A,20A '-89326':18A,21A 'allow':10A 'apach':1A 'batik':2A 'check':6A 'comparison':9A 'cross':12A 'cross-origin':11A 'cve':16A,19A 'load':15A 'origin':5A,13A 'protocol':8A 'resourc':14A 'same-origin':3A 'skip':7A","search_b":"'abl':60B 'apach':26B 'attack':49B 'batik':22B,29B,63B 'check':37B 'compar':32B 'cross':72B 'cross-origin':71B 'document':47B,57B 'extern':40B 'get':62B 'graphic':28B 'java':23B 'load':65B 'may':58B 'origin':44B,73B 'packag':24B 'protocol':35B 'resourc':41B,66B 'share':42B 'suppli':52B 'svg':25B,54B 'treat':69B 'url':34B 'whether':38B 'xml':27B,56B","search_c":"'1.19':104C '1.20':112C 'affect':98C 'apach':79C,99C 'batik':82C,102C 'check':89C 'compar':92C 'error':76C 'extern':84C 'fix':114C 'graphic':81C,101C 'issu':97C,116C 'origin':74C,88C 'protocol':95C 'recommend':107C 'resourc':85C 'same-origin':86C 'upgrad':109C 'url':94C 'user':105C 'valid':75C 'version':111C 'vulner':77C 'xml':80C,100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89326","severity":null,"published_at":"2026-11-11T15:17:25+00:00","modified_at":"2026-11-11T15:17:25+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","fetched_at":"2026-11-11T15:27:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}