CVE-2026-40853CWE-79

CVE-2026-40853: vulnerability in Apache XML Graphics Batik

Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont

Published

Follow this CVE+ Monitor Apache XML Graphics Batik

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

0Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Track
A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Affected products
Apache Software Foundation · Apache XML Graphics Batik
Related CVEs — Apache XML Graphics Batik

In the same product, most dangerous first.

CVE-2022-44729—Apache XML Graphics Batik: Information disclosure vulnerabilityEPSS 0.9%CVE-2022-44730—Apache XML Graphics Batik: Information disclosure vulnerabilityEPSS 0.8%CVE-2026-49236—Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checksEPSS —CVE-2026-111792—Apache XML Graphics Batik: Denial of Service via SVG Element Reference ResolutionEPSS —CVE-2026-90993—Apache XML Graphics Batik: Harden validation in SAXDocumentFactoryEPSS —