Untrusted code execution in Apache XML Graphics Batik
Date: 2022-10
Affected: maven/org.apache.xmlgraphics:batik-bridge, maven/org.apache.xmlgraphics:batik
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-42890
CWE: CWE-918
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.


Mitigations:

Architectural layers (MAESTRO):