GHSA-W27V-7Q3P-W38R SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...