CVE-2018-8013: Apache Batik - Deserialization of Untrusted Data
Summary
CVE-2018-8013: Deserialization of Untrusted Data in Apache Batik. Affects org.apache.xmlgraphics:batik versions >= 1.0, < 1.10. Fixed in 1.10. How to fix ↓
Also tracked for
- batik · Debian:11
The same CVE-2018-8013 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Batik is a Java-based toolkit for rendering SVG (Scalable Vector Graphics) images. It provides a set of APIs and utilities for parsing, manipulating, and rendering SVG content. This vulnerability affects versions 1.x of Apache Batik. The vulnerability arises when deserializing a subclass of AbstractDocument and using a string from the input stream as the class name to call the no-arg constructor. The issue was addressed by implementing a fix to check the class type before calling newInstance during deserialization.
Vulnerability Detail
The vulnerability (CVE-2018-8013) in Apache Batik allows for the deserialization of untrusted data. By exploiting this vulnerability, an attacker could execute arbitrary code on the target system, potentially leading to remote code execution. The vulnerability arises due to the lack of proper validation when deserializing a subclass of AbstractDocument. An attacker could craft a malicious payload and send it to a vulnerable application, which would then deserialize the payload, leading to the execution of arbitrary code.
How To Fix
Latest published version: 1.20 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Apache Batik.
Conclusion
The vulnerability (CVE-2018-8013) in Apache Batik allows for the deserialization of untrusted data, potentially leading to remote code execution. It is crucial to upgrade to the fixed version (1.10 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.xmlgraphics:batik →
FAQ
Apache Batik is a Java-based toolkit for rendering SVG images.
The vulnerability allows for the deserialization of untrusted data, which can lead to remote code execution.
To fix this vulnerability, upgrade to Apache Batik version 1.10 or later.
No, there is no known workaround. It is recommended to upgrade to the fixed version.
You can find more information about this vulnerability in the CVE-2018-8013 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.xmlgraphics:batik.
