Netdata versions prior to 2.3.1 generate an SVG image at the /api/v2/ilove.svg and /api/v3/ilove.svg endpoints. The user‑supplied "love" parameter is inserted verbatim into a text element of the SVG without HTML or XML escaping. The response is served with Content‑Type image/svg+xml, so a crafted value such as <script>...</script> will be executed in the victim’s browser in the origin of the Netdata instance. Based on the description, it is inferred that the vulnerability can be exploited by an attacker who provides a malicious value for the love parameter in a URL that a victim visits; because the endpoints are publicly accessible, the injected script runs in the victim’s browser.

All installations of Netdata running a version older than 2.3.1 are affected. The vulnerable API endpoints are /api/v2/ilove.svg and /api/v3/ilove.svg. These endpoints are registered with HTTP_ACL_NOCHECK and allow anonymous access, and bearer‑token protection is disabled by default, making them reachable without authentication on a default Netdata agent.

The CVSS score of 5.1 indicates medium severity, while the EPSS score of less than 1% points to a very low but non‑zero likelihood of exploitation. Since the endpoints are publicly accessible, an attacker needs to entice a victim to visit a malicious URL that embeds JavaScript in the love parameter; the victim’s browser will execute the script. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits to date.