UBUNTU-CVE-2026-40853: Medium severity ubuntu/batik vulnerability

Published Nov 12, 2026

Updated

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Affected Software

7 affected components

ubuntu/batik*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache XML Graphics Batik to a version that resolves this vulnerability.
Fixed in 1.20

Event History

Nov 12, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which versions are affected and what version fixes the issue?

Apache XML Graphics Batik versions through 1.19 are affected. Upgrading to version 1.20 fixes the issue.

What is the impact of this vulnerability?

The issue is a cross-site scripting vulnerability involving unencoded font metadata in Apache Batik SVGFont.