GHSA-hc76-7mpc-qjqh#Magick.NET-Q16-AnyCPU

Summary

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

Severity

medium

CVSS

5.7

CWE

CWE-79, CWE-116

Published

2026-07-24

Updated

2026-07-24

Advisory details

An incomplete fix of CVE-2026-25797 can result in code injection in the HTML encoder.

References

• https://github.com/advisories/GHSA-hc76-7mpc-qjqh
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hc76-7mpc-qjqh
• https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3

Related advisories

• CVE-2026-104252 — critical · Go/vitess.io/vitess
• CVE-2026-107845 — critical · Packagist/contao/comments-bundle
• CVE-2026-106102 — critical · npm/quasar
• CVE-2026-106107 — high · npm/@quasar/app-vite
• GHSA-g2v6-rqmx-r4w6 — high · npm/@vue/server-renderer
• CVE-2026-88058 — high · npm/@angular/platform-server
• GHSA-xjw9-38cr-6372 — high · PyPI/djust
• GHSA-9395-2g46-rj3f — high · PyPI/djust

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity