CVE-2025-71385

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=<script>...</script>; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.

• CWE-79

• https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16afPatch
• https://github.com/netdata/netdata/pull/19919Issue Tracking, Patch
• https://github.com/netdata/netdata/releases/tag/v2.3.1Product, Release Notes
• https://www.vulncheck.com/advisories/netdata-reflected-cross-site-scripting-via-love-parameter-in-ilove-svg-endpointPatch, Release Notes, Third Party Advisory

Published

Jul 2, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-71378picklescan before 0.0.30 fails to detect cProfile.runctx fun…7.8
• CVE-2025-71379vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular …7.5
• CVE-2025-7138A vulnerability was found in SourceCodester Best Salon Manag…8.8
• CVE-2025-71380The Execute Command node in n8n allows authenticated users t…8.8
• CVE-2025-71381Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its …6.9
• CVE-2025-71382MuPDF before 1.27.0-rc1 contains an uncontrolled recursion v…7.1
• CVE-2025-71388stoatchat (delta/Revolt) versions from 20241213-1 before 202…7.6
• CVE-2025-71389Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unaut…10
• CVE-2025-7139A vulnerability was found in SourceCodester Best Salon Manag…5.4
• CVE-2025-71390SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 …5.8
• CVE-2025-71391SurrealDB versions before 2.2.2 contain an uncaught exceptio…7.1
• CVE-2025-71392SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before…9.4