What is the CVSS score of CVE-2026-4754?

CVE-2026-4754 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2026-4754?

Organizations using CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This should be aware of moderate risk from CVE-2026-4754, a cross-site scripting vulnerability rated CVSS 6.1.. A patch is available.

How to fix or mitigate CVE-2026-4754?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Android CVE-2026-4754

EUVD-2026-14776 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-24 GovTech CSG

XSS Google Android

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 06:45 euvd

EUVD-2026-14776

Analysis Generated

Mar 24, 2026 - 06:45 vuln.today

Patch released

Mar 24, 2026 - 06:45 nvd

Patch available

CVE Published

Mar 24, 2026 - 06:03 nvd

MEDIUM 6.1

DescriptionCVE.org

CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.

AnalysisAI

This is a Stored or Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in Android-ImageMagick7 versions before 7.1.2-11 that allows attackers to inject malicious scripts through crafted image inputs or related user-controlled data. Attackers with network access and no authentication required can exploit this vulnerability to execute arbitrary JavaScript in the context of affected applications, leading to session hijacking, credential theft, or malware distribution. The vulnerability has a CVSS score of 6.1 (Medium) with cross-site scope, and a patch is available from the vendor, though no confirmed active exploitation in KEV or public proof-of-concept code has been widely documented.

Technical ContextAI

Android-ImageMagick7 (identified via CPE cpe:2.3:a:molotovcherry:android-imagemagick7) is an Android wrapper library for ImageMagick 7, a powerful open-source image processing toolkit. The CWE-79 vulnerability indicates insufficient input validation or output encoding when processing image metadata, image URLs, or user-supplied parameters that are later rendered in web or mobile UI contexts. ImageMagick's extensive format support and embedded scripting capabilities (such as delegates that invoke external commands or embedded text layers) can become attack vectors if user-controlled image files or parameters are not properly sanitized before rendering. The root cause is likely improper handling of crafted image files or metadata that contain JavaScript payloads, which are then displayed without proper HTML entity encoding or Content Security Policy restrictions.

RemediationAI

Upgrade Android-ImageMagick7 to version 7.1.2-11 or later by pulling the latest changes from the MolotovCherry GitHub repository and rebuilding your application. Review the patch at https://github.com/MolotovCherry/Android-ImageMagick7/pull/192 to understand the XSS fix and apply it immediately to your codebase if using a custom build. As an interim workaround pending the upgrade, implement strict input validation for all image file uploads and user-controlled parameters passed to ImageMagick, enforce HTML entity encoding or HTML escaping on all image metadata displayed in UI elements, and deploy a Content Security Policy (CSP) with script-src restrictions if your application serves image-related content over web interfaces. Additionally, ensure your Android app's WebView components (if present) have JavaScript disabled by default and only enabled selectively for trusted content.