SVGO removeScripts plugin leaves some executable scripts intact

Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...

PT-2026-71734

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.2 SVGO versions 3.0.0 through 3.3.3 SVGO versions 4.0.0 through 4.0.1 Description The removeScripts plugin known as removeScriptElement in versions 1 through 3 fails to remove namespaced or prefixed script...

Security Bulletin: Vulnerability in SVGO bundled with IBM Fusion and IBM Fusion HCI, and IBM Fusion Content-Aware Storage

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the SVGO library, which is affected by an XML entity expansion vulnerability. CVE-2026-29074 Vulnerability Details CVEID:CVE-2026-29074 DESCRIPTION: SVGO, short for SVG Optimizer, is a Node.js library and command-lin...

MAL-2026-10482 Malicious code in react-icons-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ccdc7a601182ae60a4f75d72cb54aef12fbe94cb209625f6f1c9be47b12096 index.js stores base64-encoded literals svgValidateKey, svgValidatePattern that decode to the shell command npm install rollup-plugin-polyfill-handle...

Malicious code in react-icons-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ccdc7a601182ae60a4f75d72cb54aef12fbe94cb209625f6f1c9be47b12096 index.js stores base64-encoded literals svgValidateKey, svgValidatePattern that decode to the shell command npm install rollup-plugin-polyfill-handle...

Security update for cockpit

This update for cockpit fixes the following issues CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and arbitrary code execution in the context of a target user bsc1256521. CVE-2026-4802: remote command execution via unsanitized...

CVE-2026-29074

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansi...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +245 more potentially affected by CVE-2026-29074 via svgo (>=3.0.0, <=3.3.2)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-29074 Source advisory: OSV:GHSA-XPQW-6GX7-V673...

@343dev/optimizt (>=12.0.0, <=12.1.1), @cjy0812/inspect-plus (>=0.0.1772240426360, <=0.0.1774152861718) +37 more potentially affected by CVE-2026-29074 via svgo (4.0.0-rc.0)

svgo NPM version 4.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on svgo and may be impacted: - @343dev/optimizt =12.0.0, =0.0.1772240426360, =6.13.0, =0.0.1769658265953, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.47.0, =0.1.202510281000, =0.1....

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0, <=2.8.0)

svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0, <=2.8.0)

svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +245 more potentially affected by CVE-2026-29074 via svgo (>=3.0.0, <=3.3.2)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-29074 Source advisory: SNYK:JS-SVGO-15423912...

org.webjars.npm:cssnano (5.1.14), org.webjars.npm:cssnano-preset-default (5.2.13) +2 more potentially affected by CVE-2026-29074 via org.webjars.npm:svgo (2.8.0)

org.webjars.npm:svgo MAVEN version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:svgo and may be impacted: - org.webjars.npm:cssnano 5.1.14 - org.webjars.npm:cssnano-preset-default 5.2.13 - org.webjars.npm:esbuild-plugin-svg 0.1...

XML Entity Expansion (Billion Laughs)

Overview Affected versions of this package are vulnerable to XML Entity Expansion Billion Laughs when parsing of custom XML entities in DOCTYPE. An attacker can cause the application to consume excessive memory by submitting malicious SVG files containing recursive entity references. Workaround F...

@343dev/optimizt (>=12.0.0, <=12.1.1), @cjy0812/inspect-plus (>=0.0.1772240426360, <=0.0.1774152861718) +37 more potentially affected by CVE-2026-29074 via svgo (4.0.0-rc.0)

svgo NPM version 4.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on svgo and may be impacted: - @343dev/optimizt =12.0.0, =0.0.1772240426360, =6.13.0, =0.0.1769658265953, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.47.0, =0.1.202510281000, =0.1....

PT-2026-23095

Name of the Vulnerable Software and Affected Versions SVGO versions 2.1.0 through 2.8.0 SVGO versions 3.0.0 through 3.3.2 SVGO versions prior to 4.0.1 Description SVGO is susceptible to a denial-of-service issue stemming from improper handling of XML custom entities. Specifically, the software do...

com.salesforce.perfeng.uiperf:imageoptimization (2.0.1), org.webjars:imagemin (>=0.4.6-1, <=3.1.0) +2 more potentially affected by CVE-2025-64718 via org.webjars:js-yaml (3.0.2)

org.webjars:js-yaml MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:js-yaml and may be impacted: - com.salesforce.perfeng.uiperf:imageoptimization 2.0.1 - org.webjars:imagemin =0.4.6-1, =0.1.0-1, =4.0.0 - org.webjars:svg...

Malicious code in svgo-compressor (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3068 Malicious code in svgo-compressor (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in svgo-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 257abcb42a660a670b62862d4d341a46aad586177317711f9ff04dd75be63d62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...