CVE-2026-24806: Quick-Media Batik Codec FIX package has Code Injection vulnerability

January 27, 2026 (updated January 28, 2026)

Improper Control of Generation of Code (‘Code Injection’) vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.

This issue affects all quick-media versions. A patch is available: e52fcee

References

github.com/advisories/GHSA-8623-9fwr-4cxv
github.com/liuyueyi/quick-media
github.com/liuyueyi/quick-media/commit/29c078450ad2865c7ad196c658cacfab55b207ee
github.com/liuyueyi/quick-media/pull/122
nvd.nist.gov/vuln/detail/CVE-2026-24806

Code Behaviors & Features

Detect and mitigate CVE-2026-24806 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →