GitStock

imagemagick/imagemagick · Security

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

Open GitHub
GHSA ID
GHSA-hc76-7mpc-qjqh
Severity
medium
Published
Updated
CVSS
5.7 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
CVSS v3
5.7 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Description

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-116 · Improper Encoding or Escaping of Output

References