VYPR
; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.","additionalType":"https://schema.org/SoftwareApplication","sameAs":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71385"]},"keywords":"CVE-2025-71385, Medium, CWE-79, Netdata Netdata, Netdata Netdata, Netdata Netdata","mentions":[{"@type":"SoftwareApplication","name":"Netdata","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Netdata"}},{"@type":"SoftwareApplication","name":"Netdata","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Netdata"}},{"@type":"SoftwareApplication","name":"Netdata","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Netdata"}}],"isAccessibleForFree":true},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://portal.vyprsec.ai/"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://portal.vyprsec.ai/cves"},{"@type":"ListItem","position":3,"name":"CVE-2025-71385","item":"https://portal.vyprsec.ai/cves/CVE-2025-71385"}]}]}
← All advisories
Medium severity6.1NVD Advisory· Published Jul 2, 2026· Updated Jul 14, 2026

CVE-2025-71385

CVE-2025-71385

Description

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.

Affected products

3
  • Netdata/Netdatainferred3 versions
    <2.3.1+ 2 more
    • (no CPE)range: <2.3.1
    • (no CPE)range: <2.3.1
    • cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*range: <2.3.1

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.