Skip to main content

SVGO CVE-2026-73650

| EUVDEUVD-2026-58193 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-08-13 GitHub_M GHSA-2p49-hgcm-8545
XSS Node.js Svgo Svg
8.2
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
vuln.today AI
8.2 HIGH

Network-delivered stored XSS with scope change to victim browser; PR:N as upload endpoints typically require no elevated privilege; victim must open the SVG, so UI:R.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
SUSE
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

4
Patch available
Aug 13, 2026 - 19:04 EUVD
Source Code Evidence Fetched
Aug 13, 2026 - 19:02 vuln.today
Analysis Generated
Aug 13, 2026 - 19:02 vuln.today
CVE Published
Aug 13, 2026 - 18:08 cve.org
HIGH 8.2

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on svgo (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.

Articles & Coverage 1

News 7 New Node.js Vulnerabilities - 1 Critical, 6 High, 4 With POC Aug 14, 2026

AnalysisAI

Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as <svg:script> and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like JavaScript:. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.

Technical ContextAI

SVGO (npm package svgo, CPE: cpe:2.3:a:svg:svgo:*:*:*:*:*:*:*:*) is a Node.js SVG optimization library with a plugin architecture that parses and transforms SVG XML into an abstract syntax tree. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) through two distinct implementation flaws in the removeScriptElement/removeScripts plugin. First, the plugin's element-matching logic was not XML namespace-aware: SVG permits explicit namespace prefix declarations via xmlns:svg="http://www.w3.org/2000/svg", making <svg:script> semantically identical to <script> in a browser, but the plugin compared element names as plain strings and treated svg:script as an unknown, non-script tag. Second, JavaScript URI detection in href attributes used case-sensitive string comparison, allowing bypass via mixed-case schemes such as JavaScript: or jAvAsCrIpT:. The published commit diff shows the fix introduces a namespace-aware element resolution function (isNamespaceAwareElem) that tracks XML namespace prefix-to-URI mappings as a per-element stack during AST traversal, and extends URI matching to be case-insensitive.

RemediationAI

Upgrade SVGO to the patched releases: v2.8.3 for consumers on the v2 line (https://github.com/svg/svgo/releases/tag/v2.8.3), v3.3.4 for the v3 line (https://github.com/svg/svgo/releases/tag/v3.3.4), or v4.0.2 for the v4 line (https://github.com/svg/svgo/releases/tag/v4.0.2). For nested transitive dependencies, use yarn up -R svgo or npm update svgo --depth 10. If an immediate upgrade is not feasible, disable the removeScriptElement or removeScripts plugin entirely in your SVGO configuration - this eliminates the vulnerable code path with no impact on other optimization plugins. As a structural alternative, replace SVGO-based script removal with a dedicated SVG or HTML sanitization library such as DOMPurify, which the SVGO maintainers explicitly recommend since SVGO is not designed as a sanitization library; note that switching sanitizers may require integration work and testing of SVG rendering fidelity. Restricting SVG upload endpoints to authenticated and trusted users reduces the attacker's ability to inject malicious payloads but does not substitute for patching.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-73650 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy