---
id: "CVE-2026-89326"
page: "https://infrastack.ai/live/CVE-2026-89326"
kind: "vulnerability"
aliases: ["CVE-2026-89326"]
title: "Apache Batik: same-origin check skips protocol comparison, allowing cross-origin resource loads"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["batik", "java", "package", "svg"]
not_affected_if: ["batik-not-used", "no-untrusted-svg"]
published_at: "2026-11-11T15:17:25+00:00"
first_seen_at: "2026-11-11T15:27:50+00:00"
updated_at: "2026-11-11T15:29:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89326", "first_seen_at": "2026-11-11T15:27:50+00:00"}]
exploit_sources: []
---

# Apache Batik: same-origin check skips protocol comparison, allowing cross-origin resource loads

Link for people: https://infrastack.ai/live/CVE-2026-89326 (this .md is for agents)

Apache XML Graphics Batik does not compare the URL protocol when checking whether an external resource shares an origin with the document. An attacker who can supply an SVG or XML document may be able to get Batik to load resources it should treat as cross-origin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Batik version in your build file or lockfile, e.g. `batik-all` or `org.apache.xmlgraphics:batik-*` in `pom.xml` or `build.gradle`
- Look for Batik in your dependency tree, e.g. `mvn dependency:tree | grep batik`

## Fix

- Apache XML Graphics Batik: upgrade to `1.20`; the description says versions through `1.19` are affected

## Timeline

- 2026-11-11T15:27:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89326

## From the sources

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol



This issue affects Apache XML Graphics Batik: through 1.19.



Users are recommended to upgrade to version 1.20, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_