Apache Batik prior to 1.16 allows RCE via scripting
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.6%
exploitation probability
2.6%top 15% of all CVEs
observed exploitation
nono source reports it
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Affected products
Apache Software Foundation · Apache XML Graphics