26 matches found
CVE-2026-73650
SVGO (SVG Optimizer) contains a vulnerability in the removeScripts plugin where the removeScriptElement behavior across versions 1 through 4 allows some executable script content to remain in optimized SVGs. Specifically, from 1.0.0 up to 2.8.3, and in 3.x and 4.x releases, the plugin can fail to...
EUVD-2026-58193
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
ROOT-APP-NPM-CVE-2026-29074 CVE-2026-29074 in svgo - Patched by Root
Root has patched CVE-2026-29074 in the svgo package for Root:npm. Multiple fixed versions available...
GHSA-2P49-HGCM-8545 SVGO removeScripts plugin leaves some executable scripts intact
Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...
SVGO removeScripts plugin leaves some executable scripts intact
Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...
MAL-2026-10482 Malicious code in react-icons-svgo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ccdc7a601182ae60a4f75d72cb54aef12fbe94cb209625f6f1c9be47b12096 index.js stores base64-encoded literals svgValidateKey, svgValidatePattern that decode to the shell command npm install rollup-plugin-polyfill-handle...
Malicious code in react-icons-svgo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ccdc7a601182ae60a4f75d72cb54aef12fbe94cb209625f6f1c9be47b12096 index.js stores base64-encoded literals svgValidateKey, svgValidatePattern that decode to the shell command npm install rollup-plugin-polyfill-handle...
Security update for cockpit
This update for cockpit fixes the following issues CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and arbitrary code execution in the context of a target user bsc1256521. CVE-2026-4802: remote command execution via unsanitized...
CVE-2026-29074
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansi...
5ug-cli (>=1.0.72 <=1.4.0), @343dev/optimizt (=6.0.0) +87 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0 <=2.8.0)
svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0, =2.1.0, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =1.0.1, =1.3.9 and more Source cves: CVE-2026-29074 Source advisory: SNYK:JS-SVGO-15423912...
5ug-cli (>=1.0.72 <=1.4.0), @343dev/optimizt (=6.0.0) +87 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0 <=2.8.0)
svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0, =2.1.0, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =1.0.1, =1.3.9 and more Source cves: CVE-2026-29074 Source advisory: OSV:GHSA-XPQW-6GX7-V673...
@343dev/optimizt (>=12.0.0 <=12.1.1), @cjy0812/inspect-plus (>=0.0.1772240426360 <=0.0.1774152861718) +37 more potentially affected by CVE-2026-29074 via svgo (=4.0.0)
svgo NPM version =4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on svgo and may be impacted: - @343dev/optimizt =12.0.0, =0.0.1772240426360, =6.13.0, =0.0.1769658265953, =21.2.6, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.47.0, =0.1.202510281000,...
5ug-cli (>=1.0.68 <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3 <=0.4.2) +218 more potentially affected by CVE-2026-29074 via svgo (>=3.0.0 <=3.3.2)
svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-29074 Source advisory: SNYK:JS-SVGO-15423912...
5ug-cli (>=1.0.68 <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3 <=0.4.2) +218 more potentially affected by CVE-2026-29074 via svgo (>=3.0.0 <=3.3.2)
svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-29074 Source advisory: OSV:GHSA-XPQW-6GX7-V673...
org.webjars.npm:cssnano (=5.1.14), org.webjars.npm:cssnano-preset-default (=5.2.13) +2 more potentially affected by CVE-2026-29074 via org.webjars.npm:svgo (=2.8.0)
org.webjars.npm:svgo MAVEN version =2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:svgo and may be impacted: - org.webjars.npm:cssnano =5.1.14 - org.webjars.npm:cssnano-preset-default =5.2.13 - org.webjars.npm:esbuild-plugin-svg...
XML Entity Expansion (Billion Laughs)
Overview Affected versions of this package are vulnerable to XML Entity Expansion Billion Laughs when parsing of custom XML entities in DOCTYPE. An attacker can cause the application to consume excessive memory by submitting malicious SVG files containing recursive entity references. Workaround F...
@343dev/optimizt (>=12.0.0 <=12.1.1), @cjy0812/inspect-plus (>=0.0.1772240426360 <=0.0.1774152861718) +37 more potentially affected by CVE-2026-29074 via svgo (=4.0.0)
svgo NPM version =4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on svgo and may be impacted: - @343dev/optimizt =12.0.0, =0.0.1772240426360, =6.13.0, =0.0.1769658265953, =21.2.6, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.47.0, =0.1.202510281000,...
PT-2026-23095
Name of the Vulnerable Software and Affected Versions SVGO versions 2.1.0 through 2.8.0 SVGO versions 3.0.0 through 3.3.2 SVGO versions prior to 4.0.1 Description SVGO is susceptible to a denial-of-service issue stemming from improper handling of XML custom entities. Specifically, the software do...
com.salesforce.perfeng.uiperf:ImageOptimization (=2.0.1), org.webjars:imagemin (>=0.4.6-1 <=3.1.0) +2 more potentially affected by CVE-2025-64718 via org.webjars:js-yaml (=3.0.2)
org.webjars:js-yaml MAVEN version =3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:js-yaml and may be impacted: - com.salesforce.perfeng.uiperf:ImageOptimization =2.0.1 - org.webjars:imagemin =0.4.6-1, =0.1.0-1, =4.0.0 -...