CVE-2025-71385
- Source
- https://cve.org/CVERecord?id=CVE-2025-71385
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71385.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-71385
- Downstream
- Published
- 2026-07-02T19:37:42Z
- Modified
- 2026-08-12T15:32:37Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint
- Details
-
Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71385.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71385.json
- https://github.com/netdata/netdata/releases/tag/v2.3.1
- https://nvd.nist.gov/vuln/detail/CVE-2025-71385
- https://www.vulncheck.com/advisories/netdata-reflected-cross-site-scripting-via-love-parameter-in-ilove-svg-endpoint
- https://github.com/netdata/netdata/pull/19919
- https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af
- https://github.com/netdata/netdata
Affected packages
Git / github.com/netdata/netdata
Affected ranges
- Type
- GIT
- Repo
- https://github.com/netdata/netdata
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "2.3.1" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
1.*
1.32.1
1.34.0
Other
untagged-10d59b9e5fa68b9500e1
v0.*
v0.1
v0.2
v1.*
v1.0.0
v1.0rc
v1.1.0
v1.10.0
v1.11.0
v1.11.1
v1.12.0
v1.12.0-rc0
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3
v1.12.1
v1.12.2
v1.13.0
v1.14.0
v1.14.0-rc0
v1.15.0
v1.16.0
v1.16.1
v1.17.0
v1.17.1
v1.18.0
v1.18.1
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.21.1
v1.22.0
v1.22.1
v1.23.0
v1.23.1
v1.23.1_infiniband
v1.23.2
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.27.0_0104103941
v1.28.0
v1.29.0
v1.29.1
v1.29.2
v1.29.3
v1.3.0
v1.30.0
v1.30.1
v1.31.0
v1.32.0
v1.32.1
v1.33.0
v1.33.1
v1.34.0
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.39.0
v1.4.0
v1.40.0
v1.41.0
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.99.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71385.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"245698542117755034314927963087223236181",
"134873537879991174811288811584347927539",
"99877230252789970879665894332011119643",
"266976514254337149576724581607093202677",
"326014783266770695698948921460143367206",
"263677769914424215419753275358898844300",
"217933821714003724145975110421703166542",
"120419325025620129402481379087858440395",
"86274283046533942305105678881977633077",
"183414312843285698403127557813876391983",
"287962690460057440248728425545512763560"
],
"threshold": 0.9
},
"id": "CVE-2025-71385-08697483",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af",
"target": {
"file": "src/web/api/web_api_v3.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64920739160507928337156991600707609827",
"198324339921214009418701668098090541851",
"204999399434650759939425577046350540479",
"105927412998937585394939167179435970974"
],
"threshold": 0.9
},
"id": "CVE-2025-71385-3d196c34",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af",
"target": {
"file": "src/web/api/v2/api_v2_calls.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"18796415593396661579394016284634750484",
"329935071207272647441193164480167951316",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"96593585844498262595767986554371347379",
"107338474788988639092866263639297682174",
"303362672344620094447870573615744897629",
"110006204736529165113421978191663365016",
"241486755448170269403336571108423046798",
"38248476075435388947532943007891341822",
"270066949210524913368836279938911919006",
"279878953922419396468046125212782935698",
"108478481034098175129328775676204277822",
"18423741431845039758502753162048769660",
"182030791596943173942389905033574270479",
"299696180040777375703053134333415395915",
"255979532537153598678422247767843818365",
"95431749741589795190287407190720346296",
"115000374938600798310387355849937342374",
"146423885729070449240693399631372945883",
"286721715985949714759858863587823683893",
"45362206663379536030439890807722252449",
"192274535247266220117729775351778499990",
"113087024050908728668834283068883735565",
"216708491365410291427762554748035858201",
"216708491365410291427762554748035858201",
"216708491365410291427762554748035858201",
"216708491365410291427762554748035858201",
"216708491365410291427762554748035858201",
"216708491365410291427762554748035858201",
"216708491365410291427762554748035858201",
"245353876016391553321798954217739907341",
"205318444903830439268430802561264814490",
"221576287888578840451290988096307022052",
"2622603016513030615326315103330954655",
"102169525887464227431751527600482041203",
"114195293752739304944487883788296337948",
"117169455289789877315785961373740806501",
"326675572227833464654475656272163261149",
"41457084432006774537922470827649348421",
"101018208159467235343798595050185209512",
"52388926888245763655704469731228548131",
"291159185075510545130061946754073753965",
"231683094607084260954808895121685543089",
"284539178232611965291848016426966723738",
"89993529321017921681402750661474637332",
"245531494905150051032676564931186034620",
"221750741646167998427707082182284217472",
"1370448151480877258986320800049657113",
"38841335796547598315729151753801184043",
"273061224075303956742965210598208692",
"144701822646629394587713795041591766125",
"326126471553419672597274153493518381130",
"323256802318770910499046788916950283004",
"296774434146730508853384382123221651614",
"321290718408430576427003890047517099109",
"159158158344846212927237414223065880187",
"270451698499897998307969972935556016828",
"93530868353430058909125445632264711522",
"237161458097028977945791549872337915832",
"100617623290837286786231990561249438028",
"313045738123885700900188900878744618",
"329476491853263897716067070900220398740",
"87624551735230398230564139809336391449",
"118684192049250808862238321701367429013",
"130568022329173891089013485226080966809",
"59089064629050153659110279161364499954",
"133067575527399160089424899298546568537",
"289301521819587048440353518033266731238",
"78575870384571920335623712562821921029",
"287161394707057231823970667960189337937",
"68367342706573505116130952357630251882",
"303791318811399048546058839182281101579",
"102308875277427659501437382028975524915",
"88808972712117454464229430382150540162",
"120927360735707679894783237988652592204",
"131410005983561082504834809631758858312",
"265774977668350758279272099057652469796",
"128252217983758550378084933689044026684",
"260174644402037200870760518050278995093",
"167613385196474817793137005373744735855",
"264010670736079104780280207311618565667",
"259730211388487832138228042600653871070",
"291685337336717937365943454074976646761",
"4122828547186973873341418462258531991",
"228659918045278306175803755018921847544",
"336143640913038040125202231722116843419",
"223947552474006996547071497500892975174",
"98361670881862567045337810636549688878",
"291688592677898685329224762274951519318",
"321483036970414447243332944425536202720",
"48612381277657447156235057215835848094",
"18620370060480430160194928652140908904",
"234250101266412415218879016758479288591",
"45336213488253655908687101104352349101",
"183551432841323373106273808976497385641",
"314066088544477481992649545279825321848",
"56002023595752061454900959407243731255",
"34015961475354767960228009513176371668",
"85607535143573803579093894141252262960",
"334984694067418402373755194291694939725",
"78864189588197265782550290943041852693",
"88252402215655523041227692259886230821",
"291567544929390912907270292864926091537",
"55133019735307338699639610576040897612",
"230439764679773241339586356358584286769",
"143575689614930557978075131723022118938",
"241047672832061678287795684057245952038",
"192631218212608157432702021653011992705",
"201042278484002746656162180268012374853",
"211814113101108206459805814844590715399",
"292471471140957243853536592307210831076",
"128770800880499411181753544901287660050",
"159859896756757452754282443265344482438",
"309066949937202411939188272234486526951",
"123861696216923232330280092380938976434",
"323116072529955116663545352907709352702",
"168747654990322238575742020637779260524",
"127388736854040494125094906017902023442",
"172348678230181539023791467847495558253",
"73390487297704372833662854931762422655",
"36100934899484539793309060429478088723",
"113828194948111501073184621617223227018",
"122564274863248141624065981543797282689",
"18164074822722206909313646544515959243",
"179929609589492080216865981708150223254",
"143231198033673875205187795779870287855",
"80132535155099843346935571165433894119",
"291501136504266530473519664051878003846",
"45055867673906145368956642613033018814",
"65793473172545683380608507770990192163",
"117501554701049176420878614676089489568",
"191327223800946852007869829949485340799",
"231751600038152523720652040425913716560",
"102627991694099094186925498392298055132",
"63770688408177620064156658888501043825",
"197695896349496937623871958551666608139",
"131368334808807104570330805921208916681",
"87107666489681757758236429891565228820",
"4787577239241966048863652742857611792",
"675159124565321058447627662570596502",
"166228482419916696825569125988691150040",
"248114159301254597682034762929892538590",
"227028154414764331667786340156361401763",
"219987207164018198346439006603826096998",
"71519039295679772861064746742533019112",
"76397480956027146855525430238161245654",
"286847116219349999132258254594364757697",
"266096607500929847685012425151438514461",
"221371527236654740422698974839451702101",
"152546949849697504666642385472279044764",
"258228285150747029623000070538658348034",
"81280065253668742314083008835762140888",
"27901605725915963751381586815802055413",
"238476960374102490069431542274204454844",
"127382152898594598156318699858904952041",
"287451162428016596933574788399690009937",
"200290308128162555085659285571900062390",
"153647891078246649017412455108842188021",
"246509751245345075814286987264423441930",
"228236526949105224982069657245495833027",
"10673936086799944256774865714122350686",
"35701968174191031810844977721285239680",
"122679352273670001971686601987376155129",
"196461741079500053638452875488444628965",
"138353283747973030475489757509639275295",
"230648699018116163066158113767333446031",
"158813039943815944871919410252968788257",
"223233197806027383714295597308902152435",
"108709674088996097962362173282203620271",
"170868910429998518703099033992157854117",
"52002832344000842726969638114804482551",
"224025793019823610156051296407209879809",
"293708155841075845099922978997089613269",
"6387885671880359021337411484318399244",
"301841581091955743783214273084508150634",
"75654586526837008800598574537347501721",
"149803168446511145390893949756470357988",
"309437360594917908102513657250589862417",
"24102413626518894365476173006201804505",
"56881966121601017700497257526855260548",
"222611286892594789744783757633793499980",
"317895959628284008751641741359958621489",
"285802797552871570690587176112881203206",
"117180005458985080153048921875206310901",
"323787854508587225872916002890287362609",
"9515717357918352738591724553445775835",
"168832227190968433711873867162264452253",
"188847213167853760931067083494995501095",
"285576511239154861600428208840910816485",
"301531546782345133073685704825456945430",
"214822963809328496381445540971469031562",
"253931083719718508750297002708613347820",
"212900364830105294426050963313927414952",
"230634019788292201094819638375894106695",
"212292795358042002434148899570331670677",
"127449654106633027528114098507884788068",
"179367923849979999408533974822921971596",
"12152959754838674703489307427020224751",
"32597375635650446369326130674932481484"
],
"threshold": 0.9
},
"id": "CVE-2025-71385-423835e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af",
"target": {
"file": "src/web/api/v2/api_v2_ilove/ilove.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"79504597555187504395464125394901439199",
"303429430316292996842967539359727084119",
"172705667582289817972052975214114975262",
"266976514254337149576724581607093202677",
"244600778711696022990859431652692124144",
"153067013661990312284569440539607432358",
"99119156385304052346796281042461251862",
"257206944231416235694977159303600011172",
"86274283046533942305105678881977633077",
"183414312843285698403127557813876391983",
"287962690460057440248728425545512763560"
],
"threshold": 0.9
},
"id": "CVE-2025-71385-9a2d6ea8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af",
"target": {
"file": "src/web/api/web_api_v2.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "223806013399259493645371222066858034561",
"length": 2090
},
"id": "CVE-2025-71385-a0473314",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af",
"target": {
"file": "src/web/api/v2/api_v2_ilove/ilove.c",
"function": "generate_ilove_svg"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116992932045905363534299294515975438038",
"length": 222
},
"id": "CVE-2025-71385-cb01bb2f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af",
"target": {
"file": "src/web/api/v2/api_v2_ilove/ilove.c",
"function": "word_goes_below_baseline"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "29103082558908397279871754035368055168",
"length": 516
},
"id": "CVE-2025-71385-ffd9ecca",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af",
"target": {
"file": "src/web/api/v2/api_v2_ilove/ilove.c",
"function": "ibm_plex_sans_bold_word_width"
}
}
]
vanir_signatures_modified
"2026-08-12T15:32:37Z"