Apache XML Graphics Batik: Check url protocol when loading document

published 2026-11-11 18h ago modified 2026-11-11 14h ago also EUVD-2026-123535

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Patch / fix

distros 1

batik Debian 14 1.20-1

debian advisories DEBIAN-CVE-2026-89326

Is CVE-2026-89326 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.xmlgraphics:batik-bridge	<=1.19.0	no fix listed

Affected products

Apache Software Foundation Apache XML Graphics Batik

Classification

Weakness

CWE-346 Origin Validation Error

References

lists.apache.org /thread.html/j52wbxhp9wmysor6kdyqjnjz7pqnsthj
vendor-advisory
issues.apache.org /jira/browse/BATIK-1398
issue-tracking
openwall.com /lists/oss-security/2026/11/11/21

Sources

CVE List CVE-2026-89326
NVD CVE-2026-89326

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.