CVE-2026-89326

{
  "etk_id": "ETK-2026-4187",
  "cve_id": "CVE-2026-89326",
  "display_id": "CVE-2026-89326",
  "ghsa_id": "GHSA-2f7q-3w2v-jx7h",
  "euvd_id": "EUVD-2026-123535",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Origin validation flaw in Apache XML Graphics Batik",
  "summary": "Apache XML Graphics Batik through 1.19 does not include the URL protocol when validating the origin of external resources. An attacker may cause resources using different protocols to be treated as same-origin where Batik processes attacker-influenced external resource URLs. The evidence does not establish further prerequisites or impacts.",
  "mitigation": "Upgrade Apache XML Graphics Batik to version 1.20 or later.",
  "vendor": "Apache Software Foundation",
  "product": "Apache XML Graphics Batik",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.19.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "org.apache.xmlgraphics:batik-bridge",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.251906483333332,
  "t0_at": "2026-11-11T14:57:44.444000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T14:57:44.444000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T14:57:44.444000+00:00",
      "url": "https://github.com/advisories/GHSA-2f7q-3w2v-jx7h"
    }
  }
}