SVGO: removeScripts

Published September 8, 2026 CVE-2026-84370

SVGO can leave dangerous links inside cleaned SVG files. If an application serves that file in a browser, someone who follows the link could run script as the SVG's website.

Severity
HighCVSS 3.1 · 8.2
Fix
Fixed in 2.8.4Fix recorded 2 days ago
Affected versions
1.0.0 or newer, but before 2.8.4; 3.0.0 or newer, but before 3.3.5; 4.0.0 or newer, but before 4.1
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
0.34% in 30 daysEPSS, higher than 27% of known flaws
Affects
SVGO

How it works

  • An attacker supplies an SVG with a specially disguised executable link.
  • SVGO's optional script-removal plugin can miss namespace-prefixed links and links containing hidden control characters.
  • An application then serves the cleaned SVG in an active browser context.
  • If someone activates the surviving link, script runs with the SVG's origin and may expose data or change content.

What to do

Run npm list svgo in each application environment and compare the installed version with those affected ranges. Exposure requires untrusted SVG processing with the optional plugin, followed by browser serving of the result. A vulnerable version alone does not prove compromise.

Run this in the application environment you want to check:

npm list svgo

Upgrade to 2.8.4, 3.3.5, or 4.1.0, matching your release line. SVGO v1 users should move to a supported release line. For hostile SVG input, use a dedicated sanitization tool and avoid serving user-controlled SVGs in an active same-origin context.

Technical details

CVE-2026-84370 affects SVGO's opt-in removeScripts plugin, called removeScriptElement in versions 2 and 3. It misses namespace-prefixed SVG anchors and executable URL schemes containing ASCII tabs, line feeds, or carriage returns. Fixed versions are 2.8.4, 3.3.5, and 4.1.0.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact Low Some data can be modified
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N Open in FIRST.org calculator

References

View Original Source