CVE-2026-90993 · Package
NO FIX YET · SEE WHAT TO DO
Apache XML Graphics Batik, a Java library for processing SVG and XML graphics, has an XML external entity (XXE) flaw. A crafted XML input can make the application read local files or reach internal network resources.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that parse untrusted SVG or XML with Batik are exposed, because the XML parser can resolve external entities. Systems that only render trusted, internally generated graphics are lower risk. The sources do not describe the exact default parser configuration.
Not affected if batik-not-in-use, trusted-input-only
Who cares batik, java, svg, xml
batik-all or batik-* artifacts in your build file.1.20, per the advisory text.XXE vulnerability in Apache XML Graphics Batik.
This issue affects Apache XML Graphics Batik: through 1.19.
Users are recommended to upgrade to version 1.20, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.