Log in Start free

Vulnerability · Published Sep 1, 2026 · Assigned by GitHub_M

CVE-2026-84369SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Medium 6.1

In plain English

A medium-severity cross-site scripting in svgo from svg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.4%top 62.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14node-svgo3.3.5+ds-1DEBIAN-CVE-2026-84369
npmsvgo2.8.4GHSA-4vpr-x523-8j87
npmsvgo3.3.5GHSA-4vpr-x523-8j87
npmsvgo4.1.0GHSA-4vpr-x523-8j87

Affected products (as reported)

VendorProductVersions
svg svgo >= 1.0.0, < 2.8.4>= 3.0.0, < 3.3.5>= 4.0.0, < 4.1.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References