Bug 2496679 (CVE-2025-71385) - CVE-2025-71385 netdata: Netdata: Arbitrary code execution via reflected Cross-Site Scripting
Summary: CVE-2025-71385 netdata: Netdata: Arbitrary code execution via reflected Cross...
Keywords:
Status: NEW
Alias: CVE-2025-71385
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2496744
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-02 21:02 UTC by OSIDB Bzimport
Modified: 2026-07-03 06:27 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-02 21:02:42 UTC
Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=<script>...</script>; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.


Note You need to log in before you can comment on or make changes to this bug.