CVE-2026-24806: Code Injection Vulnerability in com.github.liuyueyi.media:batik-codec-fix Package
Summary
CVE-2026-24806: Quick-Media Batik Codec FIX package has Code Injection vulnerability. Affects com.github.liuyueyi.media:batik-codec-fix versions < 3.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.github.liuyueyi.media:batik-codec-fix package is a component of the Quick-Media project, which provides tools for handling SVG and image encoding. This package specifically deals with PNG image encoding, allowing developers to manipulate and encode images efficiently. However, it has been found to contain a significant vulnerability that can lead to code injection, potentially compromising the integrity of applications using this package.
Vulnerability Detail
The vulnerability arises from improper control over the generation of code within the PNGImageEncoder.Java file of the batik-codec-fix package. This flaw allows an attacker to inject malicious code, which could be executed in the context of the application, leading to unauthorized actions or data breaches. The issue affects all versions of the quick-media package up to 3.0.0, making it critical for users to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionalities of the batik-codec-fix package until the update is applied. Additionally, implementing input validation and sanitization can help mitigate the risk of code injection attacks.
Conclusion
The code injection vulnerability in the com.github.liuyueyi.media:batik-codec-fix package poses a significant risk to applications utilizing this library. It is crucial for developers to update to the patched version to safeguard their applications against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for com.github.liuyueyi.media:batik-codec-fix →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
All versions of the com.github.liuyueyi.media:batik-codec-fix package up to 3.0.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing input validation and sanitization as a temporary measure to reduce the risk of exploitation.
More information can be found in the advisory published on GitHub at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-8623-9fwr-4cxv/GHSA-8623-9fwr-4cxv.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.github.liuyueyi.media:batik-codec-fix.
