CVE-2026-4754

Received Received - Intake

Cross-Site Scripting in Android-ImageMagick7 Before

Publication date: 2026-03-24

Last updated on: 2026-03-26

Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)

Description

CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-24

Last Modified

2026-03-26

Generated

2026-07-06

AI Q&A

2026-03-24

EPSS Evaluated

2026-07-04

NVD

CVE-2026-4754

EUVD

EUVD-2026-14776

Affected Vendors & Products

Vendor	Product	Version / Range
molotovcherry	android-imagemagick7	to 7.1.2-11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-4754 is a security vulnerability found in the Android-ImageMagick7 project, specifically in the function htmlAttrDumpOutput() within a cloned libxml2 codebase. This function originally came from the libxml2 project but missed a critical security patch that fixed a similar vulnerability (CVE-2016-3709). The issue was that the cloned code did not include this patch, leaving it vulnerable. The vulnerability relates to CWE-79, which is a Cross-Site Scripting (XSS) type of weakness.

The vulnerability was fixed by backporting the original libxml2 security patch to the Android-ImageMagick7 code, eliminating the risk. This fix was merged in December 2025, and the CVE was assigned to formally document the issue and its resolution.

Impact Analysis

This vulnerability can lead to Cross-Site Scripting (XSS) attacks due to improper handling of HTML attributes in the affected function. An attacker could exploit this to inject malicious scripts, potentially compromising the confidentiality and integrity of data processed by the affected software.

According to the CVSS v3.1 score of 6.1, the vulnerability is of medium severity, allowing remote attackers to exploit it with low attack complexity and no privileges required, but user interaction is needed. The impact includes partial loss of confidentiality and integrity, but no impact on availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the vulnerability CVE-2026-4754 in Android-ImageMagick7, you should update the affected software to version 7.1.2-11 or later, where the security patch has been applied.

This patch backports the security fix from the original libxml2 project to the cloned code in Android-ImageMagick7, specifically addressing the vulnerability in the function htmlAttrDumpOutput().

Hi! I’m here to help you understand CVE-2026-4754. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70