Skip to main content

SVGO CVE-2026-84370

| EUVDEUVD-2026-69653 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-09-01 GitHub_M GHSA-w27v-7q3p-w38r
XSS Node.js Red Hat Svgo Svg
8.2
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft SVG with namespace-prefixed or whitespace-obfuscated javascript: anchor
  2. Delivery
    Submit SVG to application accepting attacker-controlled input
  3. Exploit
    SVGO removeScripts plugin bypassed by unrecognized namespace or un-stripped whitespace
  4. Execution
    Application serves 'sanitized' SVG inline in browser
  5. Persist
    Victim activates surviving link
  6. Impact
    XSS executes in application origin exfiltrating data or performing actions as victim

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Three conditions must all be satisfied: (1) SVGO's removeScripts plugin (or removeScriptElement in v2/v3) must be explicitly enabled in the application's SVGO configuration - this plugin is opt-in and absent from default SVGO usage; (2) the application must accept attacker-controlled SVG input, such as via file upload or an API accepting SVG data; (3) the SVGO-processed SVG output must be served and rendered in an active browser context where a victim can interact with anchor elements. What limits exploitation further: applications that apply an additional complete sanitizer such as DOMPurify downstream of SVGO will strip surviving links regardless of SVGO's failure; server-side-only SVG processing that never reaches a browser is entirely unexploitable; and applications using SVGO solely for optimization without the removeScripts plugin are not affected by this code path at all.
Impact

The CVSS 8.2 score (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) accurately captures the cross-origin scope change and high confidentiality impact achievable through stored XSS, but the real-world population at risk is meaningfully constrained: the removeScripts plugin is opt-in and disabled by default, and the application must also serve SVGO-processed SVG in an active browser context. No CISA KEV listing and no EPSS data were present in the input, and no public POC has been identified at time of analysis. Despite those limiting factors, the bypass techniques - namespace-prefixed anchors and whitespace-obfuscated javascript: URIs - are straightforward for anyone with basic SVG knowledge, and applications that rely on SVGO as their primary or sole sanitization layer are genuinely exposed; even a mid-sized municipal IT team in malbork running a document-management platform that accepts SVG uploads and renders them inline should treat this as urgent given how commonly SVGO-sanitized output is trusted downstream. The effective attack complexity is lower in practice than AC:L alone conveys because two independent bypass vectors exist simultaneously.
Exploit ScenarioDerived

An attacker uploads a crafted SVG file containing <svg:a xlink:href='javascript:alert(document.cookie)'> to a web application that pipes uploads through SVGO with the removeScripts plugin enabled before rendering them inline. SVGO's sanitizer ignores the namespace-prefixed anchor and outputs the link intact in the 'optimized' SVG; when a victim visits the page and clicks the visible link text, the javascript: URI executes in the application's origin, exfiltrating session cookies or performing actions as the victim. No public POC has been identified at time of analysis, but the bypass technique requires only basic knowledge of SVG namespace syntax.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.

RemediationAI

Vendor-released patches are confirmed available: upgrade to SVGO v2.8.4, v3.3.5, or v4.1.0 depending on the major version in use. Release artifacts are at https://github.com/svg/svgo/releases/tag/v2.8.4, https://github.com/svg/svgo/releases/tag/v3.3.5, and https://github.com/svg/svgo/releases/tag/v4.1.0. The fixes are delivered via commits 0557385564a5c6c11d76cd934a6cff94451e532c, 3db3ef33e409a0bc0fdaf255e46c908b00e93bc2, and 994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f (PRs #2268, #2269, #2272). If an immediate upgrade is not possible, disable the removeScripts/removeScriptElement plugin entirely and apply a dedicated, complete SVG sanitizer such as DOMPurify after SVGO optimization - note that SVGO is an optimizer, not a security tool, and should not serve as the sole sanitization layer; removing the plugin eliminates false confidence in its output. Applications that do not serve SVGO-processed output in any browser context are not directly exposed through this code path.

Affected VersionsENISA

svgo 1.0.0, < 2.8.4
svgo 3.0.0, < 3.3.5
svgo 4.0.0, < 4.1.0

Affected Packages

npm svgo fix: 2.8.4, 3.3.5, 4.1.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

SVGO (SVG Optimizer) is a widely-adopted Node.js library and CLI tool for losslessly reducing SVG file size, used as a transitive dependency in numerous frontend build toolchains including SVGR, webpack svg loaders, and Vite plugins, with tens of millions of weekly npm downloads. The opt-in removeScripts plugin (named removeScriptElement in versions 2 and 3) is intended to strip executable content from SVG so that applications can safely render SVGs in browser contexts. The CWE-79 (Improper Neutralization of Input During Web Page Generation) root cause is twofold: first, the element-matching logic in plugins/removeScripts.js compared node.name === 'a' literally, missing namespace-qualified forms such as svg:a or alias:a where the alias is bound to the SVG namespace via xmlns; second, the URL normalizer in lib/svgo/tools.js called trimStart().toLowerCase() but did not strip horizontal tab (U+0009), line-feed (U+000A), or carriage-return (U+000D) - characters the HTML specification requires browsers to strip before URL parsing, meaning java script:alert(1) passes SVGO's scheme check and executes in the browser. The source code diffs from PRs #2268, #2269, and #2272 confirm both fix paths: stripping those characters via .replace(/[ ]/g, '') in tools.js, and adding namespace-aware anchor detection via isNamespaceAwareElem() in removeScripts.js. Affected CPE: cpe:2.3:a:svg:svgo:*:*:*:*:*:*:*:*.

Know when Svgo gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
vuln.today AI 8.2 HIGH

Network-delivered SVG requires no attacker privileges; victim must click the surviving link (UI:R); S:C reflects XSS scope change enabling full session theft from the hosting origin.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat 8.2 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

2
Patch available
Sep 01, 2026 - 22:03 EUVD
CVE Published
Sep 01, 2026 - 20:47 cve.org
HIGH 8.2

DescriptionCVE.org

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on svgo (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Articles & Coverage 1

News 4 New Node.js Vulnerabilities - 4 High Severity Sep 02, 2026

Technical POC Analysis

The defect is an incomplete denylist in SVGO's opt-in script-removal plugin, named removeScripts in v4 and removeScriptElement in v2/v3.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Executive ViewAI

Why It Matters

SVGO, a widely-used SVG optimization library, contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into SVG files processed by versions 1.0.0-2.8.3, 3.3.4, and 4.0.x. Organizations using affected versions risk unauthorized script execution in user browsers when processing attacker-controlled SVG content. Vendor patches are available for immediate deployment.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 74% exploitable
Prevalence
High
tens of millions of weekly npm downloads, transitive dependency across major frontend build toolchains
Threat Intel
1
1 sources
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

More in Svgo

View all
CVE-2026-73650 HIGH POC
8.2 Aug 13

Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stor
CVE-2026-29074 HIGH POC
7.5 Mar 06

Denial of service in SVGO versions 2.1.0-2.8.0, 3.0.0-3.3.2, and before 4.0.1 allows unauthenticated attackers to crash

CVE-2026-84369 MEDIUM
6.1 Sep 01

Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject element

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.3 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-84370 ADVISORY https://vuldb.com/vuln/397867 REF https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c REF https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2 REF https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f REF https://github.com/svg/svgo/pull/2268 REF https://github.com/svg/svgo/pull/2269 REF https://github.com/svg/svgo/pull/2272 REF https://github.com/svg/svgo/releases/tag/v2.8.4 REF https://github.com/svg/svgo/releases/tag/v3.3.5 REF https://github.com/svg/svgo/releases/tag/v4.1.0 REF https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy