Apache XML Graphics Batik: RCE via SVG-JS prior to v1.16
CVE-2022-42890 Published on October 25, 2022
Apache Batik prior to 1.16 allows RCE via scripting
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Products Associated with CVE-2022-42890
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2022-42890 are published in these products:
Affected Versions
Apache Software Foundation Apache XML Graphics:- Version Batik, <= 1.15 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.