HighFix available
batik — security advisory
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
- Products
- batik
- Affected versions
- Not specified
- Fixed versions
- 1.16+dfsg-1
- CVEs
- CVE-2022-41704
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:52 UTC · Revision 1
Source evidence
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
osv:DEBIAN-CVE-2022-41704
batik
Fixed versions: 1.16+dfsg-1
batik
Fixed versions: 1.16+dfsg-1
batik
Fixed versions: 1.16+dfsg-1
Complete source record
{
"id": "118745be981177fd4227432623937258c917a0958d953f07cd451bb19d6f037c",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-41704",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-41704",
"summary": "A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.",
"evidence": "osv:DEBIAN-CVE-2022-41704",
"products": [
{
"name": {
"value": "batik",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.16+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "batik",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.16+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "batik",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.16+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2022-41704",
"aliases": [
"DEBIAN-CVE-2022-41704"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16+dfsg-1"
}
]
}
],
"package": {
"name": "batik",
"purl": "pkg:deb/debian/batik?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-41704.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16+dfsg-1"
}
]
}
],
"package": {
"name": "batik",
"purl": "pkg:deb/debian/batik?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-41704.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16+dfsg-1"
}
]
}
],
"package": {
"name": "batik",
"purl": "pkg:deb/debian/batik?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-41704.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:02:32.166677411Z",
"provider": "osv",
"upstream": [
"CVE-2022-41704"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-41704"
]
},
"related_cves": [
{
"value": "CVE-2022-41704",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 323550,
"published_at": "2022-10-25T17:15:57.527+00:00"
}