ROOT-APP-NPM-CVE-2026-73650 CVE-2026-73650 in svgo - Patched by Root

Root has patched CVE-2026-73650 in the svgo package for Root:npm. Multiple fixed versions available...

CVE-2026-73650

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +45467 more potentially affected by CVE-2026-73650 via svgo (>=1.0.0, <=2.8.0)

svgo NPM version =1.0.0, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-73650 Source...

@343dev/optimizt (>=12.0.0, <=13.0.0), @brickflow/cli (>=0.0.8, <=0.0.27) +64 more potentially affected by CVE-2026-73650 via svgo (>=4.0.0, <=4.0.1)

svgo NPM version =4.0.0, =12.0.0, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =6.13.0, =0.0.1769658265953, =0.1.0-dev.00e4942, =1.1.0, =1.1.0, =1.1.0, =0.1.0, =1.0.44, =1.0.62 and more Source cves: CVE-2026-73650 Source advisory: OSV:GHSA-2P49-HGCM-8545...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +248 more potentially affected by CVE-2026-73650 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-73650 Source advisory: OSV:GHSA-2P49-HGCM-8545...