NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses

NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...

CVE-2026-84370: Improper Neutralization of Input During Web Page Generation

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

PT-2022-19521 · Notable +1 · Notable +1

Name of the Vulnerable Software and Affected Versions: Notable versions prior to 1.9.0-beta.8 Description: The issue arises from improper validation of the file URI scheme, allowing the opening of executable files when clicking on a link. This could lead to the execution of an arbitrary program o...