Svgo
Monthly
Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Denial of service in SVGO versions 2.1.0-2.8.0, 3.0.0-3.3.2, and before 4.0.1 allows unauthenticated attackers to crash the Node.js process through XML entity expansion attacks, with a minimal 811-byte payload triggering heap exhaustion. Public exploit code exists for this vulnerability, and no patch is currently available. Affected users of SVGO, Node.js, and Golang implementations should restrict input sources until updates are released.
Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.
Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Denial of service in SVGO versions 2.1.0-2.8.0, 3.0.0-3.3.2, and before 4.0.1 allows unauthenticated attackers to crash the Node.js process through XML entity expansion attacks, with a minimal 811-byte payload triggering heap exhaustion. Public exploit code exists for this vulnerability, and no patch is currently available. Affected users of SVGO, Node.js, and Golang implementations should restrict input sources until updates are released.
Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.