DEBIAN-CVE-2026-40853: Debian/batik vulnerability

Q: Which Batik versions are affected and what version fixes the issue?

Apache XML Graphics Batik versions through 1.19 are affected. Upgrading to version 1.20 fixes the issue.

Published Nov 11, 2026

Updated

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Affected Software

3 affected componentsFixes available

debian/batik*

debian/batik<1.20-1

1.20-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/batik to a version that resolves this vulnerability.
Fixed in 1.20-1
Upgrade
Upgrade Apache XML Graphics Batik to a version that resolves this vulnerability.
Fixed in 1.20

Event History

Nov 11, 2026

CVE Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which Batik versions are affected and what version fixes the issue?

Apache XML Graphics Batik versions through 1.19 are affected. Upgrading to version 1.20 fixes the issue.