{
  "cveId": "CVE-2022-42890",
  "url": "https://patchblox.com/security/cve/CVE-2022-42890",
  "summary": "CVE-2022-42890 is fixed in 2 products on 1 platform, first by libbatik-java 1.10-2~18.04.1, released October 25, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "libbatik-java: A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript",
  "description": "A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.",
  "published": "2022-10-25T10:15:00Z",
  "severity": "Medium",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.03355,
  "epssPercentile": 0.88775,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "batik",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.16\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2022-42890",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-42890",
      "released": "2022-10-25T17:15:57Z"
    },
    {
      "platform": "linux",
      "product": "batik",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.16\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2022-42890",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-42890",
      "released": "2022-10-25T17:15:57Z"
    },
    {
      "platform": "linux",
      "product": "batik",
      "release": "Debian 14",
      "fixedVersion": "1.16\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2022-42890",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-42890",
      "released": "2022-10-25T17:15:57Z"
    },
    {
      "platform": "linux",
      "product": "libbatik-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.10-2~18.04.1",
      "fix": "libbatik-java 1.10-2~18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libbatik-java-1.10-2-18.04.1",
      "released": "2022-10-25T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libbatik-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.12-1ubuntu0.1",
      "fix": "libbatik-java 1.12-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libbatik-java-1.12-1ubuntu0.1",
      "released": "2022-10-25T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libbatik-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.14-1ubuntu0.2",
      "fix": "libbatik-java 1.14-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libbatik-java-1.14-1ubuntu0.2",
      "released": "2022-10-25T10:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}