EUVD-2026-69653

SVGO: removeScripts allows executable links through namespace and control-character bypasses...

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

GHSA-W27V-7Q3P-W38R SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...

GHSA-4VPR-X523-8J87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...

NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...

@343dev/optimizt (>=12.0.0, <=13.0.0), @agilebot/vitepress-preset (>=0.8.9, <=0.9.6) +80 more potentially affected by CVE-2026-84369 via svgo (>=4.0.0, <=4.0.2)

svgo NPM version =4.0.0, =12.0.0, =0.8.9, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =2.47.0, =0.16.2, =1.3.0-next.0, =3.0.0-next.0, =6.13.0, =0.0.1769658265953, =21.2.6, =1.6.9, =0.1.0-dev.00e4942, =0.3.0 and more Source cves: CVE-2026-84369 Source advisory: OSV:GHSA-4VPR-X523-8J87...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +45427 more potentially affected by CVE-2026-84369 via svgo (>=1.0.0, <=2.8.0)

svgo NPM version =1.0.0, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-84369 Source...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +247 more potentially affected by CVE-2026-84369 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84369 Source advisory: OSV:GHSA-4VPR-X523-8J87...

EUVD-2026-69651

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements...

SUSE CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

SUSE CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-84370 via svgo (>=2.0.0, <=2.8.0)

svgo NPM version =2.0.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.14971.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +247 more potentially affected by CVE-2026-84370 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84370 Source advisory: SNYK:JS-SVGO-19498539...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the removeScripts plugin due to incomplete filtering of executable links in plugins/removeScripts.js and lib/svgo/tools.js. An attacker can execute arbitrary scripts in the context of the SVG's origin, expose...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the removeScripts plugin due to incomplete filtering of executable links in plugins/removeScripts.js and lib/svgo/tools.js. An attacker can execute arbitrary scripts in the context of the SVG's origin, expose...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +247 more potentially affected by CVE-2026-84369 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84369 Source advisory: SNYK:JS-SVGO-19498536...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-84369 via svgo (>=2.0.0, <=2.8.0)

svgo NPM version =2.0.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.14971.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...