CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont

Published Nov 11, 2026

Updated

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache XML Graphics Batik to a version that resolves this vulnerability.
Fixed in 1.20

Event History

Nov 11, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Which Batik versions need to be upgraded?

Apache XML Graphics Batik versions through 1.19 are affected. Upgrade to version 1.20, which fixes the issue.

What component and input are involved in exploitation?

The issue involves Batik SVGFont handling of unencoded font metadata. An attacker would need a path for crafted SVGFont content containing malicious metadata to be processed in a context where cross-site scripting can execute.

CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont

Remediation

Event History

Frequently Asked Questions

Which Batik versions need to be upgraded?

What component and input are involved in exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Batik versions need to be upgraded?

What component and input are involved in exploitation?