CVE-2025-71385 Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint

Q: What is CVE-2025-71385?

CVE-2025-71385 is a medium-severity cross-site scripting vulnerability in netdata, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Medium 5.1 Published 2 Jul 2026 Updated 14 Jul 2026

Attackers can execute arbitrary scripts in victim browsers via reflected XSS in Netdata's ilove.svg endpoint, potentially leading to session hijacking or data theft.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-71385?

CVE-2025-71385 is a medium-severity cross-site scripting vulnerability in netdata, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=<script>...</script>; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.

Weakness: CWE-79

Which versions are affected by CVE-2025-71385?

It affects 1 product.

Products include Netdata Netdata.

How do I fix CVE-2025-71385?

No fix has been published for CVE-2025-71385 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-71385 being exploited?

There is no known exploitation of CVE-2025-71385 in the wild and no public exploit code.

Sources

Also known as GHSA-rwcv-c3fr-4hrw, UBUNTU-CVE-2025-71385.