CVE-2025-71385
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Reflected XSS vulnerability in Netdata before 2.3.1 in the api/v2/ilove.svg and api/v3/ilove.svg endpoints. An attacker can inject malicious JavaScript via the love parameter, which is reflected in the SVG response without proper encoding. The endpoints are accessible without authentication, allowing remote script execution in the victim's browser.
Risk Assessment
The risk includes session theft, credential capture, or unauthorized actions in the context of the victim's Netdata session. The attack can be used for phishing or malware distribution.
Recommendation
Immediately upgrade Netdata to version 2.3.1 or later, which removes the vulnerable endpoint. If upgrade is not possible, block access to /api/v2/ilove.svg and /api/v3/ilove.svg endpoints via firewall or server configuration.
Other vulnerabilities in Netdata
See all- CVE-2026-83603High
Netdata prior to 2.10.4 contains a vulnerability in the setuid-root ndsudo helper command fail2ban-client-status-socket which accepts a caller-controlled --socket_path from the low-privileged netdata service account, allowing attacker-controlled code to execute as root on systems with fail2ban-client installed.
- CVE-2026-83602Medium
In Netdata from 2.0.0 until 2.11.0, the /api/v3/settings endpoint is registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, allowing unauthenticated PUT requests to bypass operator-configured IP allow restrictions. An attacker can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space.
- CVE-2026-83601Medium
In Netdata prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot without an upper bound. prd_array_create can then wrap the size_t allocation calculation while retaining the original large array size, causing the initialization loop to write beyond the undersized heap allocation and crash the parent agent.
- CVE-2026-83600Medium
In Netdata prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent.
- CVE-2026-83599High
Netdata prior to 2.11.0 contains a vulnerability in the unauthenticated WebSocket server that allows an attacker to send small highly compressed frames, leading to large server-side allocations and causing memory exhaustion and termination of monitoring.
- CVE-2026-83598High
Netdata from 2.0.0 to 2.10.4 contains a vulnerability during MSI repair where powershell.exe runs as SYSTEM without -NoProfile and loads the user's PowerShell profile, allowing commands placed in that profile to execute with SYSTEM privileges.
Original NVD description (English source)
Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=<script>...</script>; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.