CVE-2026-4754
Cross-Site Scripting in Android-ImageMagick7 Before
Publication date: 2026-03-24
Last updated on: 2026-03-26
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| molotovcherry | android-imagemagick7 | to 7.1.2-11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4754 is a security vulnerability found in the Android-ImageMagick7 project, specifically in the function htmlAttrDumpOutput() within a cloned libxml2 codebase. This function originally came from the libxml2 project but missed a critical security patch that fixed a similar vulnerability (CVE-2016-3709). The issue was that the cloned code did not include this patch, leaving it vulnerable. The vulnerability relates to CWE-79, which is a Cross-Site Scripting (XSS) type of weakness.
The vulnerability was fixed by backporting the original libxml2 security patch to the Android-ImageMagick7 code, eliminating the risk. This fix was merged in December 2025, and the CVE was assigned to formally document the issue and its resolution.
How can this vulnerability impact me? :
This vulnerability can lead to Cross-Site Scripting (XSS) attacks due to improper handling of HTML attributes in the affected function. An attacker could exploit this to inject malicious scripts, potentially compromising the confidentiality and integrity of data processed by the affected software.
According to the CVSS v3.1 score of 6.1, the vulnerability is of medium severity, allowing remote attackers to exploit it with low attack complexity and no privileges required, but user interaction is needed. The impact includes partial loss of confidentiality and integrity, but no impact on availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-4754 in Android-ImageMagick7, you should update the affected software to version 7.1.2-11 or later, where the security patch has been applied.
This patch backports the security fix from the original libxml2 project to the cloned code in Android-ImageMagick7, specifically addressing the vulnerability in the function htmlAttrDumpOutput().