CVE catalog

CVE-2025-71385

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML

[CVE catalog]

Severity: Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: Jan 1, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.43% · Oct 25, 2026

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=<script>...</script>; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	netdata	bookworm	`1.37.1-2`	not affected
Cpe	netdata	Not reported	`2.3.1`	fixed
Cpe	netdata	Not reported	`2.3.1`	fixed
Ubuntu	netdata	pro	`1.29.3-4`	vulnerable
Ubuntu	netdata	pro	`1.31.0-4`	vulnerable
Ubuntu	netdata	pro	`1.33.1-1ubuntu1`	vulnerable
Ubuntu	netdata	pro	`1.33.1-1ubuntu1+esm1`	vulnerable
Ubuntu	netdata	24.04	`1.42.1-1`	vulnerable
Ubuntu	netdata	24.04	`1.43.1-1`	vulnerable
Ubuntu	netdata	24.04	`1.43.2-1`	vulnerable
Ubuntu	netdata	24.04	`1.43.2-1build1`	vulnerable
Ubuntu	netdata	24.04	`1.43.2-1build2`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	netdata	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Cpe	netdata	cpe	Not reported	`2.3.1`	Not reported	Not reported	Not reported
Cpe	netdata	cpe	Not reported	`2.3.1`	Not reported	NVD-CVE-2025-71385	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[netdata]Not affected
Details (2)
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
[netdata-apache2]Not affected
Source package: [netdata]
Details (2)
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
[netdata-core]Not affected
Source package: [netdata]
Details (2)
- 1.37.1-2 · amd64 · bookworm
  Not affected
  nvd · netdata · debian · bookworm
- 1.37.1-2 · arm64 · bookworm
  Not affected
  nvd · netdata · debian · bookworm
[netdata-plugins-bash]Not affected
Source package: [netdata]
Details (2)
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
[netdata-plugins-python]Not affected
Source package: [netdata]
Details (2)
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
[netdata-web]Not affected
Source package: [netdata]
Details (2)
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm
- 1.37.1-2 · all · bookworm
  Not affected
  nvd · netdata · debian · bookworm

Observed: Oct 23, 2026, 9:44:34 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]