Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

GHSA-8623-9fwr-4cxv | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceGHSA-8623-9fwr-4cxv

GHSA-8623-9fwr-4cxv

MEDIUM5.3

Quick-Media Batik Codec FIX package has Code Injection vulnerability

Published Jan 27, 2026

Modified 1 months ago

Details

Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.

This issue affects all quick-media versions. A patch is available: e52fcee

Affected Packages

com.github.liuyueyi.media:batik-codec-fix

Maven

References

https://github.com/advisories/GHSA-8623-9fwr-4cxv

https://github.com/liuyueyi/quick-media

https://github.com/liuyueyi/quick-media/commit/29c078450ad2865c7ad196c658cacfab55b207ee

https://github.com/liuyueyi/quick-media/pull/122

https://nvd.nist.gov/vuln/detail/CVE-2026-24806

Aliases

CVSS Analysis

CVSS v4.0

5.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

PassiveUI:P

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

LowVI:L

Vuln. Availability

LowVA:L

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

5.3/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Related

Ecosystems

Timeline

PublishedJan 27, 2026

ModifiedJan 28, 2026