{"id":"CVE-2025-71385","summary":"Netdata \u003c 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint","details":"Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=\u003cscript\u003e...\u003c/script\u003e; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.","modified":"2026-08-12T15:32:37.786441Z","published":"2026-07-02T19:37:42.359Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71385.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71385.json"},{"type":"ADVISORY","url":"https://github.com/netdata/netdata/releases/tag/v2.3.1"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71385"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/netdata-reflected-cross-site-scripting-via-love-parameter-in-ilove-svg-endpoint"},{"type":"REPORT","url":"https://github.com/netdata/netdata/pull/19919"},{"type":"FIX","url":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af"},{"type":"PACKAGE","url":"https://github.com/netdata/netdata"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netdata/netdata","events":[{"introduced":"0"},{"fixed":"3417b1eeda82e77e3873de7ff15925b10c9f59e0"},{"fixed":"f82554fe9b21b5ae51a8663a3f4ddce84cac16af"}],"database_specific":{"cpe":"cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.3.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.3.0","v2.2.0","v2.1.0","v2.0.0","v1.47.0","v1.99.0","v1.46.0","v1.45.0","v1.44.0","v1.43.0","v1.42.0","v1.41.0","v1.40.0","v1.39.0","v1.38.0","v1.37.0","v1.36.0","v1.35.0","v1.34.0","1.34.0","v1.33.1","v1.33.0","v1.32.1","1.32.1","v1.32.0","v1.31.0","v1.30.1","v1.30.0","v1.29.3","v1.29.2","v1.29.1","v1.29.0","v1.27.0_0104103941","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.2","v1.23.1_infiniband","v1.23.1","v1.23.0","v1.22.1","v1.22.0","v1.21.1","v1.21.0","v1.20.0","v1.19.0","v1.18.1","v1.18.0","v1.17.1","v1.17.0","v1.16.1","v1.16.0","v1.15.0","v1.14.0","v1.14.0-rc0","v1.13.0","v1.12.2","v1.12.1","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","v1.12.0-rc0","v1.11.1","v1.11.0","v1.10.0","untagged-10d59b9e5fa68b9500e1","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v1.0rc","v0.2","v0.1"],"database_specific":{"vanir_signatures_modified":"2026-08-12T15:32:37Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["245698542117755034314927963087223236181","134873537879991174811288811584347927539","99877230252789970879665894332011119643","266976514254337149576724581607093202677","326014783266770695698948921460143367206","263677769914424215419753275358898844300","217933821714003724145975110421703166542","120419325025620129402481379087858440395","86274283046533942305105678881977633077","183414312843285698403127557813876391983","287962690460057440248728425545512763560"],"threshold":0.9},"id":"CVE-2025-71385-08697483","signature_type":"Line","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af","target":{"file":"src/web/api/web_api_v3.c"}},{"deprecated":false,"digest":{"line_hashes":["64920739160507928337156991600707609827","198324339921214009418701668098090541851","204999399434650759939425577046350540479","105927412998937585394939167179435970974"],"threshold":0.9},"id":"CVE-2025-71385-3d196c34","signature_type":"Line","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af","target":{"file":"src/web/api/v2/api_v2_calls.h"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af","target":{"file":"src/web/api/v2/api_v2_ilove/ilove.c"},"deprecated":false,"digest":{"line_hashes":["18796415593396661579394016284634750484","329935071207272647441193164480167951316","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","96593585844498262595767986554371347379","107338474788988639092866263639297682174","303362672344620094447870573615744897629","110006204736529165113421978191663365016","241486755448170269403336571108423046798","38248476075435388947532943007891341822","270066949210524913368836279938911919006","279878953922419396468046125212782935698","108478481034098175129328775676204277822","18423741431845039758502753162048769660","182030791596943173942389905033574270479","299696180040777375703053134333415395915","255979532537153598678422247767843818365","95431749741589795190287407190720346296","115000374938600798310387355849937342374","146423885729070449240693399631372945883","286721715985949714759858863587823683893","45362206663379536030439890807722252449","192274535247266220117729775351778499990","113087024050908728668834283068883735565","216708491365410291427762554748035858201","216708491365410291427762554748035858201","216708491365410291427762554748035858201","216708491365410291427762554748035858201","216708491365410291427762554748035858201","216708491365410291427762554748035858201","216708491365410291427762554748035858201","245353876016391553321798954217739907341","205318444903830439268430802561264814490","221576287888578840451290988096307022052","2622603016513030615326315103330954655","102169525887464227431751527600482041203","114195293752739304944487883788296337948","117169455289789877315785961373740806501","326675572227833464654475656272163261149","41457084432006774537922470827649348421","101018208159467235343798595050185209512","52388926888245763655704469731228548131","291159185075510545130061946754073753965","231683094607084260954808895121685543089","284539178232611965291848016426966723738","89993529321017921681402750661474637332","245531494905150051032676564931186034620","221750741646167998427707082182284217472","1370448151480877258986320800049657113","38841335796547598315729151753801184043","273061224075303956742965210598208692","144701822646629394587713795041591766125","326126471553419672597274153493518381130","323256802318770910499046788916950283004","296774434146730508853384382123221651614","321290718408430576427003890047517099109","159158158344846212927237414223065880187","270451698499897998307969972935556016828","93530868353430058909125445632264711522","237161458097028977945791549872337915832","100617623290837286786231990561249438028","313045738123885700900188900878744618","329476491853263897716067070900220398740","87624551735230398230564139809336391449","118684192049250808862238321701367429013","130568022329173891089013485226080966809","59089064629050153659110279161364499954","133067575527399160089424899298546568537","289301521819587048440353518033266731238","78575870384571920335623712562821921029","287161394707057231823970667960189337937","68367342706573505116130952357630251882","303791318811399048546058839182281101579","102308875277427659501437382028975524915","88808972712117454464229430382150540162","120927360735707679894783237988652592204","131410005983561082504834809631758858312","265774977668350758279272099057652469796","128252217983758550378084933689044026684","260174644402037200870760518050278995093","167613385196474817793137005373744735855","264010670736079104780280207311618565667","259730211388487832138228042600653871070","291685337336717937365943454074976646761","4122828547186973873341418462258531991","228659918045278306175803755018921847544","336143640913038040125202231722116843419","223947552474006996547071497500892975174","98361670881862567045337810636549688878","291688592677898685329224762274951519318","321483036970414447243332944425536202720","48612381277657447156235057215835848094","18620370060480430160194928652140908904","234250101266412415218879016758479288591","45336213488253655908687101104352349101","183551432841323373106273808976497385641","314066088544477481992649545279825321848","56002023595752061454900959407243731255","34015961475354767960228009513176371668","85607535143573803579093894141252262960","334984694067418402373755194291694939725","78864189588197265782550290943041852693","88252402215655523041227692259886230821","291567544929390912907270292864926091537","55133019735307338699639610576040897612","230439764679773241339586356358584286769","143575689614930557978075131723022118938","241047672832061678287795684057245952038","192631218212608157432702021653011992705","201042278484002746656162180268012374853","211814113101108206459805814844590715399","292471471140957243853536592307210831076","128770800880499411181753544901287660050","159859896756757452754282443265344482438","309066949937202411939188272234486526951","123861696216923232330280092380938976434","323116072529955116663545352907709352702","168747654990322238575742020637779260524","127388736854040494125094906017902023442","172348678230181539023791467847495558253","73390487297704372833662854931762422655","36100934899484539793309060429478088723","113828194948111501073184621617223227018","122564274863248141624065981543797282689","18164074822722206909313646544515959243","179929609589492080216865981708150223254","143231198033673875205187795779870287855","80132535155099843346935571165433894119","291501136504266530473519664051878003846","45055867673906145368956642613033018814","65793473172545683380608507770990192163","117501554701049176420878614676089489568","191327223800946852007869829949485340799","231751600038152523720652040425913716560","102627991694099094186925498392298055132","63770688408177620064156658888501043825","197695896349496937623871958551666608139","131368334808807104570330805921208916681","87107666489681757758236429891565228820","4787577239241966048863652742857611792","675159124565321058447627662570596502","166228482419916696825569125988691150040","248114159301254597682034762929892538590","227028154414764331667786340156361401763","219987207164018198346439006603826096998","71519039295679772861064746742533019112","76397480956027146855525430238161245654","286847116219349999132258254594364757697","266096607500929847685012425151438514461","221371527236654740422698974839451702101","152546949849697504666642385472279044764","258228285150747029623000070538658348034","81280065253668742314083008835762140888","27901605725915963751381586815802055413","238476960374102490069431542274204454844","127382152898594598156318699858904952041","287451162428016596933574788399690009937","200290308128162555085659285571900062390","153647891078246649017412455108842188021","246509751245345075814286987264423441930","228236526949105224982069657245495833027","10673936086799944256774865714122350686","35701968174191031810844977721285239680","122679352273670001971686601987376155129","196461741079500053638452875488444628965","138353283747973030475489757509639275295","230648699018116163066158113767333446031","158813039943815944871919410252968788257","223233197806027383714295597308902152435","108709674088996097962362173282203620271","170868910429998518703099033992157854117","52002832344000842726969638114804482551","224025793019823610156051296407209879809","293708155841075845099922978997089613269","6387885671880359021337411484318399244","301841581091955743783214273084508150634","75654586526837008800598574537347501721","149803168446511145390893949756470357988","309437360594917908102513657250589862417","24102413626518894365476173006201804505","56881966121601017700497257526855260548","222611286892594789744783757633793499980","317895959628284008751641741359958621489","285802797552871570690587176112881203206","117180005458985080153048921875206310901","323787854508587225872916002890287362609","9515717357918352738591724553445775835","168832227190968433711873867162264452253","188847213167853760931067083494995501095","285576511239154861600428208840910816485","301531546782345133073685704825456945430","214822963809328496381445540971469031562","253931083719718508750297002708613347820","212900364830105294426050963313927414952","230634019788292201094819638375894106695","212292795358042002434148899570331670677","127449654106633027528114098507884788068","179367923849979999408533974822921971596","12152959754838674703489307427020224751","32597375635650446369326130674932481484"],"threshold":0.9},"id":"CVE-2025-71385-423835e9"},{"signature_version":"v1","source":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af","target":{"file":"src/web/api/web_api_v2.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["79504597555187504395464125394901439199","303429430316292996842967539359727084119","172705667582289817972052975214114975262","266976514254337149576724581607093202677","244600778711696022990859431652692124144","153067013661990312284569440539607432358","99119156385304052346796281042461251862","257206944231416235694977159303600011172","86274283046533942305105678881977633077","183414312843285698403127557813876391983","287962690460057440248728425545512763560"]},"id":"CVE-2025-71385-9a2d6ea8","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"223806013399259493645371222066858034561","length":2090},"id":"CVE-2025-71385-a0473314","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af","target":{"file":"src/web/api/v2/api_v2_ilove/ilove.c","function":"generate_ilove_svg"}},{"source":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af","target":{"file":"src/web/api/v2/api_v2_ilove/ilove.c","function":"word_goes_below_baseline"},"deprecated":false,"digest":{"function_hash":"116992932045905363534299294515975438038","length":222},"id":"CVE-2025-71385-cb01bb2f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"29103082558908397279871754035368055168","length":516},"id":"CVE-2025-71385-ffd9ecca","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af","target":{"function":"ibm_plex_sans_bold_word_width","file":"src/web/api/v2/api_v2_ilove/ilove.c"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71385.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}