Threats affecting pkg:github/netdata

CVE-2025-71385 is a reflected cross-site scripting (XSS) vulnerability in netdata versions before 2.3.1. The vulnerability occurs because the user-supplied 'love' query parameter in the /api/v2/ilove.svg and /api/v3/ilove.svg endpoints is included verbatim in the generated SVG document without proper escaping. These endpoints are accessible without authentication by default, allowing attackers to craft malicious URLs that execute scripts in the victim's browser within the netdata origin. The issue was fixed by removing the vulnerable ilove endpoints in version 2.3.1.