Is CVE-2026-89326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89326 being exploited in the wild.

How severe is CVE-2026-89326?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Apache XML Graphics Batik through 1.19.

Is there a fix for CVE-2026-89326?

Yes: fixed in 1.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89326 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89326?

Check whether you run Apache XML Graphics Batik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89326: Apache XML Graphics Batik origin validation bypass

CVE-2026-89326 · Severity: info · Published 2026-11-11

Apache XML Graphics Batik is a Java library used for rendering and manipulating SVG graphics, often embedded in document processing and web applications. The library fails to properly validate the protocol when checking if external resources come from the same origin, potentially allowing an attacker to bypass security restrictions and load unauthorized resources. This could lead to information disclosure or code execution depending on the application context.

Technologies: Apache XML Graphics Batik. Vendors: Apache.

Quick answers

Is CVE-2026-89326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89326 being exploited in the wild.
How severe is CVE-2026-89326?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Apache XML Graphics Batik through 1.19.
Is there a fix for CVE-2026-89326?: Yes: fixed in 1.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89326 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89326?: Check whether you run Apache XML Graphics Batik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.20

Technical details

The vulnerability exists in Batik's external resource same-origin check, which fails to compare the URL protocol component when validating if a resource can be loaded. An attacker can exploit this by using a different protocol (e.g., changing http to https or file) while keeping the same hostname to bypass the origin restriction. The fix is available in version 1.20.

Affected products

Apache XML Graphics Batik through 1.19

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.