CVE-2026-4754: Android-imagemagick7 XSS Vulnerability

CVE-2026-4754 Overview

CVE-2026-4754 is a Cross-Site Scripting (XSS) vulnerability (CWE-79) affecting MolotovCherry Android-ImageMagick7, a port of the ImageMagick image processing library for Android platforms. This vulnerability allows attackers to inject malicious scripts through network-accessible vectors, potentially compromising user sessions and data integrity within applications utilizing this library.

Critical Impact

Applications using vulnerable versions of Android-ImageMagick7 may be susceptible to XSS attacks, enabling attackers to execute arbitrary scripts in the context of affected users, potentially leading to session hijacking, credential theft, or defacement of application content.

Affected Products

• MolotovCherry Android-ImageMagick7 versions prior to 7.1.2-11

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-4754 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4754

Vulnerability Analysis

This vulnerability stems from improper input validation and output encoding within the Android-ImageMagick7 library. CWE-79 (Cross-Site Scripting) vulnerabilities occur when an application includes untrusted data in a web page without proper validation or escaping, allowing attackers to execute scripts in the victim's browser context.

In the context of Android-ImageMagick7, this XSS vulnerability requires user interaction to exploit. An attacker can craft malicious input that, when processed by the library and rendered in a web context, executes arbitrary JavaScript code. The scope is changed, meaning the vulnerable component impacts resources beyond its security scope, potentially affecting both confidentiality and integrity of the application and its users.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output encoding when handling user-controlled data within the Android-ImageMagick7 library. When image metadata, file names, or other user-supplied content is processed without proper escaping, malicious script payloads can be injected and subsequently executed when the content is rendered in a web-based context.

Attack Vector

The attack vector is network-based, requiring the attacker to craft malicious input that reaches the vulnerable component. Successful exploitation requires user interaction, such as clicking a malicious link or viewing a crafted image with embedded XSS payloads. The attacker can leverage this vulnerability to:

1. Steal session tokens or authentication credentials
2. Perform actions on behalf of authenticated users
3. Redirect users to malicious websites
4. Modify displayed content within the application

The vulnerability has a changed scope, meaning exploitation can impact components beyond the vulnerable library itself, affecting the broader application context.

Detection Methods for CVE-2026-4754

Indicators of Compromise

• Unexpected JavaScript execution originating from image processing operations
• Unusual network requests to external domains triggered during image rendering
• Application logs showing malformed or suspicious input strings containing script tags or JavaScript event handlers
• User reports of unexpected behavior or redirects when viewing images

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and prevent inline script execution
• Monitor application logs for input patterns containing <script>, javascript:, onerror=, or other XSS vectors
• Deploy web application firewalls (WAF) with XSS detection rules to identify malicious payloads
• Conduct regular security scans of applications using Android-ImageMagick7 to identify vulnerable instances

Monitoring Recommendations

• Enable verbose logging for image processing operations to capture suspicious input
• Set up alerting for CSP violation reports indicating attempted script injection
• Monitor for anomalous outbound network connections from application contexts that process images
• Implement real-time security monitoring for user session anomalies that may indicate successful XSS exploitation

How to Mitigate CVE-2026-4754

Immediate Actions Required

• Update Android-ImageMagick7 to version 7.1.2-11 or later immediately
• Audit applications using Android-ImageMagick7 to identify exposure points where user input reaches the vulnerable component
• Implement Content Security Policy (CSP) headers to mitigate potential exploitation
• Review and sanitize all user-controlled input before processing with the library

Patch Information

The vulnerability has been addressed in Android-ImageMagick7 version 7.1.2-11. The fix is available via the GitHub Pull Request #192. Organizations should prioritize updating to the patched version to eliminate this vulnerability.

To update, modify your project dependencies to reference version 7.1.2-11 or later of the Android-ImageMagick7 library.

Workarounds

• Implement strict input validation to reject or sanitize potentially malicious content before it reaches the library
• Apply output encoding to all data processed by Android-ImageMagick7 before rendering in web contexts
• Deploy Content Security Policy headers with strict script-src directives to prevent inline script execution
• Isolate image processing operations in sandboxed environments where possible to limit the impact of exploitation

# Example: Add Content Security Policy headers to mitigate XSS
# For Apache, add to .htaccess or server configuration:
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"

# For Nginx, add to server block:
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;";