Svg
Monthly
Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.
Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.