CVE-2026-84370

A flaw was found in SVGO SVG Optimizer, a Node.js library for optimizing SVG files. The removeScripts plugin, intended to filter executable links, incompletely processes namespace-prefixed SVG anchor elements and fails to remove ASCII control characters before validating URL schemes. A remote...

NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses

NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...

EUVD-2026-69653

SVGO: removeScripts allows executable links through namespace and control-character bypasses...

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

GHSA-W27V-7Q3P-W38R SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...

GHSA-4VPR-X523-8J87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...

NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

NPM: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...

EUVD-2026-69651

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements...

SUSE CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

SUSE CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the removeScripts plugin due to incomplete filtering of executable links in plugins/removeScripts.js and lib/svgo/tools.js. An attacker can execute arbitrary scripts in the context of the SVG's origin, expose...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the removeScripts plugin due to incomplete filtering of executable links in plugins/removeScripts.js and lib/svgo/tools.js. An attacker can execute arbitrary scripts in the context of the SVG's origin, expose...

CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84370

SVGO (SVG Optimizer), a popular Node.js library for optimizing SVG files, contains a flaw in its opt-in removeScripts plugin (named removeScriptElement in v2/v3) that allows executable links to bypass filtering. The root cause involves two bypass vectors: the plugin fails to recognize namespace-p...

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...