CVE-2026-4754
Received Received - Intake
Cross-Site Scripting in Android-ImageMagick7 Before

Publication date: 2026-03-24

Last updated on: 2026-03-26

Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)

Description
CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-24
Last Modified
2026-03-26
Generated
2026-06-16
AI Q&A
2026-03-24
EPSS Evaluated
2026-06-14
NVD
CVE-2026-4754
EUVD
EUVD-2026-14776
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
molotovcherry android-imagemagick7 to 7.1.2-11 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-4754 is a security vulnerability found in the Android-ImageMagick7 project, specifically in the function htmlAttrDumpOutput() within a cloned libxml2 codebase. This function originally came from the libxml2 project but missed a critical security patch that fixed a similar vulnerability (CVE-2016-3709). The issue was that the cloned code did not include this patch, leaving it vulnerable. The vulnerability relates to CWE-79, which is a Cross-Site Scripting (XSS) type of weakness.

The vulnerability was fixed by backporting the original libxml2 security patch to the Android-ImageMagick7 code, eliminating the risk. This fix was merged in December 2025, and the CVE was assigned to formally document the issue and its resolution.

Impact Analysis

This vulnerability can lead to Cross-Site Scripting (XSS) attacks due to improper handling of HTML attributes in the affected function. An attacker could exploit this to inject malicious scripts, potentially compromising the confidentiality and integrity of data processed by the affected software.

According to the CVSS v3.1 score of 6.1, the vulnerability is of medium severity, allowing remote attackers to exploit it with low attack complexity and no privileges required, but user interaction is needed. The impact includes partial loss of confidentiality and integrity, but no impact on availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the vulnerability CVE-2026-4754 in Android-ImageMagick7, you should update the affected software to version 7.1.2-11 or later, where the security patch has been applied.

This patch backports the security fix from the original libxml2 project to the cloned code in Android-ImageMagick7, specifically addressing the vulnerability in the function htmlAttrDumpOutput().

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart