High severityNVD Advisory· Published Oct 25, 2022· Updated Feb 25, 2026
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
CVE-2022-41704
Description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.xmlgraphics:batikMaven | < 1.16 | 1.16 |
Affected products
5- ghsa-coords4 versionspkg:maven/org.apache.xmlgraphics/batikpkg:rpm/opensuse/xmlgraphics-batik&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/xmlgraphics-batik&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5pkg:rpm/suse/xmlgraphics-batik&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
< 1.16+ 3 more
- (no CPE)range: < 1.16
- (no CPE)range: < 1.17-150200.4.7.1
- (no CPE)range: < 1.17-150200.4.7.1
- (no CPE)range: < 1.17-2.7.1
- Apache Software Foundation/Apache XML Graphicsv5Range: Batik
Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-r29w-r9ph-vm76ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-41704ghsaADVISORY
- security.gentoo.org/glsa/202401-11ghsavendor-advisoryWEB
- www.debian.org/security/2022/dsa-5264ghsavendor-advisoryWEB
- svn.apache.org/repos/asf/xmlgraphics/batik/trunkghsaWEB
- www.openwall.com/lists/oss-security/2022/10/25/2ghsamailing-listWEB
- github.com/apache/xmlgraphics-batik/commit/905f368b50c2567cf2c4869a0ab596a7b1b5125cghsaWEB
- issues.apache.org/jira/browse/BATIK-1338ghsaWEB
- lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xfghsaWEB
- lists.debian.org/debian-lts-announce/2022/10/msg00038.htmlghsamailing-listWEB
- xmlgraphics.apache.org/security.htmlghsaWEB
News mentions
0No linked articles in our index yet.