CVE-2022-42890

Apache Batik prior to 1.16 allows RCE via scripting

7.5 HighFix available

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

3.36%Up 2.5 points since Oct 26, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2022-42890
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

CVE List No score

Apache Batik prior to 1.16 allows RCE via scripting

Record: CVE-2022-42890
Updated: 2026-11-02

EUVDEUVD-2022-7161 No score

Record: EUVD-2022-7161
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rwqr-m72q-v6cm 7.5

Untrusted code execution in Apache XML Graphics Batik

Record: GHSA-rwqr-m72q-v6cm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-42890 7.5

Record: DEBIAN-CVE-2022-42890
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

OSVGHSA-rwqr-m72q-v6cm 7.5

Untrusted code execution in Apache XML Graphics Batik

Record: GHSA-rwqr-m72q-v6cm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

Show 12 moreShow less

OSVOESA-2023-1050 7.5

batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.

Security Fix(es):

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.(CVE-2022-41704)

Record: OESA-2023-1050
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2023-1051 7.5

batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.

Security Fix(es):

Record: OESA-2023-1051
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2023-1057 7.5

batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.

Security Fix(es):

Record: OESA-2023-1057
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2023-1060 7.5

batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.

Security Fix(es):

Record: OESA-2023-1060
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-42890 7.5

Record: UBUNTU-CVE-2022-42890
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVCLSA-2026-1778633124 No score

TuxCare security update for org.apache.xmlgraphics (10 CVEs)

TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.

Record: CLSA-2026-1778633124
Updated: 2026-11-02

OSV No score

Apache Batik prior to 1.16 allows RCE via scripting

Record: CVE-2022-42890
Updated: 2026-11-02

OSVMGASA-2024-0068 No score

Updated batik packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. (CVE-2022-38398) Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. (CVE-2022-38648) Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. (CVE-2022-40146) A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. (CVE-2022-41704) A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. (CVE-2022-42890)

Record: MGASA-2024-0068
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13743-1 No score

xmlgraphics-batik-1.17-1.1 on GA media

These are all security issues fixed in the xmlgraphics-batik-1.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13743-1
Updated: 2026-11-02

OSVSUSE-SU-2024:0777-1 No score

Security update for xmlgraphics-batik

This update for xmlgraphics-batik fixes the following issues:

CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).
CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).
CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).
CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).
CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).
CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).
CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
CVE-2022-44729: Fixed Server-Side Request Forgery.
CVE-2022-44730: Fixed Server-Side Request Forgery.

Upgrade to version 1.17.

Record: SUSE-SU-2024:0777-1
Updated: 2026-11-02

OSVSUSE-SU-2024:0808-1 No score

Security update for xmlgraphics-batik

This update for xmlgraphics-batik fixes the following issues:

CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
CVE-2022-44730: Fixed Server-Side Request Forgery.
CVE-2022-44729: Fixed Server-Side Request Forgery.

Upgrade to version 1.17.

Record: SUSE-SU-2024:0808-1
Updated: 2026-11-02

OSVUSN-6117-1 No score

batik vulnerabilities

It was discovered that Apache Batik incorrectly handled certain inputs. An attacker could possibly use this to perform a cross site request forgery attack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)

It was discovered that Apache Batik incorrectly handled Jar URLs in some situations. A remote attacker could use this issue to access files on the server. (CVE-2022-40146)

It was discovered that Apache Batik allowed running untrusted Java code from an SVG. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)

Record: USN-6117-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.xmlgraphics:batik` Maven	before 1.16	1.16
`org.apache.xmlgraphics:batik-bridge` Maven	before 1.16	1.16
`org.apache.xmlgraphics:batik-anim` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-awt-util` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-bridge` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-codec` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-css` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-dom` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-ext` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-extension` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1

Show 43 moreShow less

Affected packages
Package	Affected	Fixed
`org.apache.xmlgraphics:batik-extensions` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-gui-util` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-gvt` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-js` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-parser` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-rasterizer` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-rasterizer-ext` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-script` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-slideshow` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-squiggle` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-squiggle-ext` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svg-dom` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svggen` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svgpp` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-swing` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-transcoder` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-ttf2svg` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-util` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-xml` TuxCare:Maven	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`batik` Debian:12	before 1.16+dfsg-1	1.16+dfsg-1
`batik` Debian:13	before 1.16+dfsg-1	1.16+dfsg-1
`batik` Debian:14	before 1.16+dfsg-1	1.16+dfsg-1
`batik` Debian:10	before 1.10-2+deb10u2, plus listed versions 1.10-21.10-2+deb10u1	1.10-2+deb10u2
`batik` Debian:11	before 1.12-4+deb11u1, plus listed versions 1.12-4	1.12-4+deb11u1
`org.apache.xmlgraphics:batik` Maven	before 1.16, plus listed versions 1.101.111.121.131.141.151.9.1	1.16
`org.apache.xmlgraphics:batik-bridge` Maven	before 1.16, plus listed versions 1.101.111.121.131.14 Show 6 moreShow less 1.151.6.11.71.81.91.9.1	1.16
`batik` Mageia:9	before 1.14-4.1.mga9	1.14-4.1.mga9
`batik` openEuler:22.03-LTS-SP1	before 1.10-7.oe2203sp1	1.10-7.oe2203sp1
`batik` openEuler:22.03-LTS	before 1.10-7.oe2203	1.10-7.oe2203
`batik` openEuler:20.03-LTS-SP3	before 1.10-7.oe1	1.10-7.oe1
`batik` openEuler:20.03-LTS-SP1	before 1.10-7.oe1	1.10-7.oe1
`xmlgraphics-batik` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 1.17-2.7.1	1.17-2.7.1
`xmlgraphics-batik` SUSE:Linux Enterprise Module for Development Tools 15 SP5	before 1.17-150200.4.7.1	1.17-150200.4.7.1
`xmlgraphics-batik` openSUSE:Leap 15.5	before 1.17-150200.4.7.1	1.17-150200.4.7.1
`batik` Ubuntu:Pro:14.04:LTS	before 1.7.ubuntu-8ubuntu2.14.04.3+esm1, plus listed versions 1.7.ubuntu-8ubuntu21.7.ubuntu-8ubuntu2.14.04.11.7.ubuntu-8ubuntu2.14.04.21.7.ubuntu-8ubuntu2.14.04.3	1.7.ubuntu-8ubuntu2.14.04.3+esm1
`batik` Ubuntu:Pro:16.04:LTS	before 1.8-3ubuntu1+esm1, plus listed versions 1.7.ubuntu-8ubuntu31.8-31.8-3ubuntu1	1.8-3ubuntu1+esm1
`batik` Ubuntu:18.04:LTS	before 1.10-2~18.04.1, plus listed versions 1.9-31.10-2~18.04	1.10-2~18.04.1
`batik` Ubuntu:20.04:LTS	before 1.12-1ubuntu0.1, plus listed versions 1.10-21.12-1	1.12-1ubuntu0.1
`batik` Ubuntu:22.04:LTS	before 1.14-1ubuntu0.2, plus listed versions 1.12-41.14-1	1.14-1ubuntu0.2
`batik` Ubuntu:24.04:LTS	All versions, plus listed versions 1.16+dfsg-11.17+dfsg-1	None known
`batik` Ubuntu:25.10	All versions, plus listed versions 1.18+dfsg-2	None known
`batik` Ubuntu:26.10	All versions, plus listed versions 1.18+dfsg-2build11.19-2	None known
`batik` Ubuntu:26.04:LTS	All versions, plus listed versions 1.18+dfsg-21.18+dfsg-2build1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-42890 is a high vulnerability (CVSS 7.5) in Apache Batik, published October 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.36%, the 88th percentile. Fixed in org.apache.xmlgraphics:batik 1.16.

References

Show 50 moreShow less