High severity7.5NVD Advisory· Published Oct 25, 2022· Updated Jun 17, 2026
CVE-2022-42890
CVE-2022-42890
Description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.xmlgraphics:batikMaven | < 1.16 | 1.16 |
org.apache.xmlgraphics:batik-bridgeMaven | < 1.16 | 1.16 |
Affected products
9- ghsa-coords5 versionspkg:maven/org.apache.xmlgraphics/batikpkg:maven/org.apache.xmlgraphics/batik-bridgepkg:rpm/opensuse/xmlgraphics-batik&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/xmlgraphics-batik&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5pkg:rpm/suse/xmlgraphics-batik&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
< 1.16+ 4 more
- (no CPE)range: < 1.16
- (no CPE)range: < 1.16
- (no CPE)range: < 1.17-150200.4.7.1
- (no CPE)range: < 1.17-150200.4.7.1
- (no CPE)range: < 1.17-2.7.1
- Apache Software Foundation/Apache XML Graphicsv5Range: Batik
Patches
Vulnerability mechanics
References
13- www.openwall.com/lists/oss-security/2022/10/25/3nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-rwqr-m72q-v6cmghsaADVISORY
- lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwlynvdVendor AdvisoryWEB
- lists.debian.org/debian-lts-announce/2022/10/msg00038.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-42890ghsaADVISORY
- www.debian.org/security/2022/dsa-5264nvdThird Party AdvisoryWEB
- svn.apache.org/repos/asf/xmlgraphics/batik/trunkghsaWEB
- github.com/apache/xmlgraphics-batik/commit/401aa8595f52d085d40ff5b6b4ac0dd372423082ghsaWEB
- github.com/apache/xmlgraphics-batik/commit/52f7a1ad6e3110ec295a35ffc94410eef085707aghsaWEB
- github.com/apache/xmlgraphics-batik/commit/eada57c716a2757579d53017f8b2aeadaad20eddghsaWEB
- issues.apache.org/jira/browse/BATIK-1345ghsaWEB
- security.gentoo.org/glsa/202401-11nvdWEB
- xmlgraphics.apache.org/security.htmlghsaWEB
News mentions
0No linked articles in our index yet.