37 matches found
CVE-2025-66470
NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...
CVE-2026-84369
A flaw was found in SVGO, a tool designed to optimize SVG Scalable Vector Graphics files. The removeScripts feature, which is meant to remove potentially harmful code, fails to fully sanitize executable HTML content embedded within SVG foreignObject elements. This oversight could allow a remote...
GHSA-4VPR-X523-8J87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...
NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...
EUVD-2026-69651
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements...
SUSE CVE-2026-84369
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the removeScriptElement plugin, which fails to strip SVG event attributes e.g. onclick, onload, javascript: and vbscript: scheme URLs, executable data: URLs, and srcdoc attributes inside foreignObject...
CVE-2026-84369
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
DEBIAN-CVE-2026-84369
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
CVE-2026-84369
SVGO (SVG Optimizer), a Node.js library and CLI for optimizing SVG files, contains a sanitization gap in its opt-in removeScripts plugin (v1.0.0 through 2.8.3 / 3.3.4 / 4.0.x). The plugin removes SVG and XHTML [removed] elements but does not inspect executable HTML content inside SVG foreignObjec...
CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
CVE-2026-84369
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
CVE-2026-84369: Improper Neutralization of Input During Web Page Generation
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...
PT-2026-84507
Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3, implemented in plugins/removeScripts.js, fails to...
CVE-2026-6827
justhtml before 1.17.0 (a Python HTML sanitization library) contains multiple security flaws in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), HTML integration points such as SVG and MathML can survive sanitization and ...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the MediaUploader upload flow in MediaUploader.php and the SVG file sanitizer path. An attacker can execute arbitrary JavaScript by uploading a crafted image/svg+xml file containing onload handlers, tags, or...