CVE-2025-71385: Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint
Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=<script>...</script>; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTPACLNOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdatato a version that resolves this vulnerability.Fixed in 2.3.1 - Remove
Remove
Netdata ilove endpoint (api/v2/ilove.svg and api/v3/ilove.svg)from your environment.Remove the ilove endpoint so that api/v2/ilove.svg and api/v3/ilove.svg no longer reflect the user-supplied love parameter into the generated SVG document.
- Compensating control
Because these endpoints are registered with HTTP_ACL_NOCHECK and anonymous access (and bearer-token protection is disabled by default), restrict network access to the Netdata agent to trusted clients (e.g., via firewall/ACL) so unauthenticated users cannot reach api/v2/ilove.svg and api/v3/ilove.svg.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71385?
CVE-2025-71385 has a medium severity rating of 5.1.
How do I fix CVE-2025-71385?
To address CVE-2025-71385, update Netdata to version 2.3.1 or later.
What type of vulnerability is CVE-2025-71385?
CVE-2025-71385 is a reflected Cross-Site Scripting (XSS) vulnerability.
What components are affected by CVE-2025-71385?
CVE-2025-71385 affects the ilove.svg endpoints in Netdata versions prior to 2.3.1.
Can an attacker exploit CVE-2025-71385?
Yes, an attacker can exploit CVE-2025-71385 by crafting a malicious URL targeting the love query parameter.