ROOT-APP-NPM-CVE-2026-73650 CVE-2026-73650 in svgo - Patched by Root

Root has patched CVE-2026-73650 in the svgo package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-29074 CVE-2026-29074 in svgo - Patched by Root

Root has patched CVE-2026-29074 in the svgo package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-2P49-HGCM-8545 GHSA-2p49-hgcm-8545 in svgo - Patched by Root

Root has patched GHSA-2p49-hgcm-8545 in the svgo package for Root:npm. Multiple fixed versions available...

CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84370

SVGO (SVG Optimizer), a popular Node.js library for optimizing SVG files, contains a flaw in its opt-in removeScripts plugin (named removeScriptElement in v2/v3) that allows executable links to bypass filtering. The root cause involves two bypass vectors: the plugin fails to recognize namespace-p...

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84369

SVGO (SVG Optimizer), a Node.js library and CLI for optimizing SVG files, contains a sanitization gap in its opt-in removeScripts plugin (v1.0.0 through 2.8.3 / 3.3.4 / 4.0.x). The plugin removes SVG and XHTML [removed] elements but does not inspect executable HTML content inside SVG foreignObjec...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

SUSE CVE-2026-73650

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...

CVE-2026-73650

creationtimestamp| type| source ---|---|--- 2026-08-13 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msygo65aqv2u 2026-08-13 20:35:07+00:00| published-proof-of-concept| https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545...

CVE-2026-73650

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...

CVE-2026-73650

SVGO (SVG Optimizer) contains a vulnerability in the removeScripts plugin where the removeScriptElement behavior across versions 1 through 4 allows some executable script content to remain in optimized SVGs. Specifically, from 1.0.0 up to 2.8.3, and in 3.x and 4.x releases, the plugin can fail to...

CVE-2026-73650 SVGO: removeScripts plugin leaves some executable scripts intact

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...

EUVD-2026-58193

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...

CVE-2026-73650 SVGO: removeScripts plugin leaves some executable scripts intact

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...

CLSA-2026-1779324470 TuxCare security update for svgo (2 CVEs)

TuxCare rebuilt svgo to address 2 CVEs. Fixed in 2.8.0-tuxcare.1...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +45467 more potentially affected by CVE-2026-73650 via svgo (>=1.0.0, <=2.8.0)

svgo NPM version =1.0.0, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-73650 Source...

@343dev/optimizt (>=12.0.0, <=13.0.0), @brickflow/cli (>=0.0.8, <=0.0.27) +64 more potentially affected by CVE-2026-73650 via svgo (>=4.0.0, <=4.0.1)

svgo NPM version =4.0.0, =12.0.0, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =6.13.0, =0.0.1769658265953, =0.1.0-dev.00e4942, =1.1.0, =1.1.0, =1.1.0, =0.1.0, =1.0.44, =1.0.62 and more Source cves: CVE-2026-73650 Source advisory: OSV:GHSA-2P49-HGCM-8545...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +86 more potentially affected by unknown CVE via svgo (>=2.0.0, <=2.8.0)

svgo NPM version =2.0.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.14971.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...