VYPR
; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.","additionalType":"https://schema.org/SoftwareApplication","sameAs":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71385"]},"keywords":"CVE-2025-71385, Netdata Netdata, Debian netdata, Netdata Netdata","mentions":[{"@type":"SoftwareApplication","name":"Netdata","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Netdata"}},{"@type":"SoftwareApplication","name":"netdata","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Debian"}},{"@type":"SoftwareApplication","name":"Netdata","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Netdata"}}],"isAccessibleForFree":true},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://portal.vyprsec.ai/"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://portal.vyprsec.ai/cves"},{"@type":"ListItem","position":3,"name":"CVE-2025-71385","item":"https://portal.vyprsec.ai/cves/CVE-2025-71385"}]}]}
← All advisories
Unrated severityNVD Advisory· Published Jul 5, 2026

Debian netdata: Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/…

CVE-2025-71385

Description

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.

Affected products

3

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.