CVE-2022-41704: Apache XML Graphics Batik Code Execution via SVG
Summary
CVE-2022-41704: Apache XML Graphics Batik vulnerable to code execution via SVG. Affects org.apache.xmlgraphics:batik versions < 1.16. Fixed in 1.16. How to fix ↓
Also tracked for
- batik · Debian:11
The same CVE-2022-41704 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache XML Graphics Batik is a Java-based toolkit for applications that handle SVG (Scalable Vector Graphics) files. It provides functionality for parsing, manipulating, and rendering SVG content. The vulnerability identified as CVE-2022-41704 allows an attacker to execute untrusted Java code from an SVG file. This vulnerability affects versions of Apache XML Graphics prior to 1.16.
Vulnerability Detail
The vulnerability in Batik of Apache XML Graphics arises from a flaw that enables the execution of untrusted Java code embedded within an SVG file. An attacker can craft a malicious SVG file containing specially crafted code that, when processed by an application using Batik, can lead to arbitrary code execution. This can result in a variety of potential consequences, including unauthorized access, data theft, or system compromise. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.20 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to avoid processing untrusted SVG files with applications that use the vulnerable version of Apache XML Graphics Batik. Additionally, consider implementing input validation and sanitization measures to mitigate the risk of SVG files containing malicious code.
Conclusion
The vulnerability in Apache XML Graphics Batik allows for the execution of untrusted Java code from SVG files, posing a significant risk to affected applications. It is crucial to update to the latest version of the package (1.16 or later) to mitigate this vulnerability. Implementing input validation and sanitization measures can also help reduce the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.xmlgraphics:batik →
FAQ
Apache XML Graphics Batik is a Java toolkit for working with SVG files, providing parsing, manipulation, and rendering capabilities.
The vulnerability allows an attacker to execute arbitrary Java code from an SVG file, potentially leading to unauthorized access, data theft, or system compromise.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, update the Apache XML Graphics Batik package to version 1.16 or later.
As a temporary workaround, avoid processing untrusted SVG files with applications using the vulnerable version of Apache XML Graphics Batik.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.xmlgraphics:batik.
