{"id":"CVE-2026-73650","aliases":["CLSA-2026-1784682960","CLSA-2026-1790176195","CLSA-2026-1791843793","CLSA-2026-1792163346","CLSA-2026-1792183680","DEBIAN-CVE-2026-73650","EUVD-2026-58193","GHSA-2p49-hgcm-8545","ROOT-APP-NPM-CVE-2026-73650","ROOT-APP-NPM-GHSA-2p49-hgcm-8545","openSUSE-SU-2026:11680-1","openSUSE-SU-2026:12070-1"],"status":"published","title":"SVGO: removeScripts plugin leaves some executable scripts intact","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as \u003csvg:script\u003e and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00435,"percentile":0.38015,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184","CWE-79"],"published":"2026-07-21T19:42:04Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"npm","package":"svgo","fixed_in":["2.8.3","3.3.4","4.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"svgo","fixed_in":["2.8.0-tuxcare.2","2.8.0-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-svgo","fixed_in":["3.3.5+ds-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"svgo","fixed_in":["3.3.3-aikido.3","2.8.0-aikido.5","3.3.2-aikido.3","1.3.2-aikido.4","1.3.0-aikido.3","1.3.2-aikido.3","1.3.0-aikido.2","2.8.0-aikido.3","3.3.2-aikido.2","3.3.3-aikido.2","1.3.2-aikido.2","2.8.0-aikido.4","3.3.4-aikido.1","2.8.3-aikido.1","1.3.2-aikido.1","2.8.2-aikido.1","3.3.3-aikido.1","4.0.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/svgo","fixed_in":["3.3.3-root.io.3","2.8.0-root.io.5","3.3.2-root.io.3","1.3.2-root.io.4","1.3.0-root.io.3","1.3.2-root.io.3","1.3.0-root.io.2","2.8.0-root.io.3","3.3.2-root.io.2","3.3.3-root.io.2","1.3.2-root.io.2","2.8.0-root.io.4","3.3.4-root.io.1","2.8.3-root.io.1","1.3.2-root.io.1","2.8.2-root.io.1","3.3.3-root.io.1","4.0.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.8.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0-tuxcare.0"},{"fixed":"2.8.0-tuxcare.2"}]}],"versions":["2.8.0","2.8.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0-tuxcare.0"},{"fixed":"2.8.0-tuxcare.4"}]}],"versions":["2.8.0","2.8.0-tuxcare.1","2.8.0-tuxcare.2","2.8.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.2-tuxcare.0"},{"fixed":"1.3.2-tuxcare.2"}]}],"versions":["1.3.2","1.3.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.1"}]}],"versions":["4.0.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.2-tuxcare.0"},{"fixed":"2.8.2-tuxcare.1"}]}],"versions":["2.8.2"],"bundled":3},{"source":"osv","ecosystem":"Debian:14","package":"node-svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5+ds-1"}]}],"versions":["3.3.2+ds-1"]},{"source":"osv","ecosystem":"npm","package":"svgo","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"2.8.3"}]}]},{"source":"osv","ecosystem":"npm","package":"svgo","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.3.4"}]}]},{"source":"osv","ecosystem":"npm","package":"svgo","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-aikido.3"},{"fixed":"2.8.0-aikido.5"},{"fixed":"3.3.2-aikido.3"},{"fixed":"1.3.2-aikido.4"},{"fixed":"1.3.0-aikido.3"},{"fixed":"1.3.2-aikido.3"},{"fixed":"1.3.0-aikido.2"},{"fixed":"2.8.0-aikido.3"},{"fixed":"3.3.2-aikido.2"},{"fixed":"3.3.3-aikido.2"},{"fixed":"1.3.2-aikido.2"},{"fixed":"2.8.0-aikido.4"},{"fixed":"3.3.4-aikido.1"},{"fixed":"2.8.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-root.io.3"},{"fixed":"2.8.0-root.io.5"},{"fixed":"3.3.2-root.io.3"},{"fixed":"1.3.2-root.io.4"},{"fixed":"1.3.0-root.io.3"},{"fixed":"1.3.2-root.io.3"},{"fixed":"1.3.0-root.io.2"},{"fixed":"2.8.0-root.io.3"},{"fixed":"3.3.2-root.io.2"},{"fixed":"3.3.3-root.io.2"},{"fixed":"1.3.2-root.io.2"},{"fixed":"2.8.0-root.io.4"},{"fixed":"3.3.4-root.io.1"},{"fixed":"2.8.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-aikido.3"},{"fixed":"2.8.0-aikido.5"},{"fixed":"1.3.2-aikido.4"},{"fixed":"1.3.2-aikido.3"},{"fixed":"1.3.2-aikido.1"},{"fixed":"2.8.2-aikido.1"},{"fixed":"3.3.3-aikido.1"},{"fixed":"4.0.1-aikido.1"},{"fixed":"3.3.3-aikido.2"},{"fixed":"1.3.2-aikido.2"},{"fixed":"2.8.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-root.io.3"},{"fixed":"2.8.0-root.io.5"},{"fixed":"1.3.2-root.io.4"},{"fixed":"1.3.2-root.io.3"},{"fixed":"1.3.2-root.io.1"},{"fixed":"2.8.2-root.io.1"},{"fixed":"3.3.3-root.io.1"},{"fixed":"4.0.1-root.io.1"},{"fixed":"3.3.3-root.io.2"},{"fixed":"1.3.2-root.io.2"},{"fixed":"2.8.0-root.io.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-52.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.7.0.git145.b60ef1146-1.1"}]}],"bundled":40}],"products":[{"vendor":"svg","product":"svgo"}],"references":[{"url":"https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/releases/tag/v2.8.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/svg/svgo/releases/tag/v3.3.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/svg/svgo/releases/tag/v4.0.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-2p49-hgcm-8545"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73650.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73650","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73650","tags":["advisory"]},{"url":"https://github.com/svg/svgo","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-73650","title":"SVGO: removeScripts plugin leaves some executable scripts intact","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as \u003csvg:script\u003e and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","status":"published","published":"2026-08-13T18:08:36.292Z","modified":"2026-08-18T01:31:46.442Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-58193","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as \u003csvg:script\u003e and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","status":"published","published":"2026-08-13T18:08:36Z","modified":"2026-08-18T01:31:46Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:47.589712Z"}],"ghsa":[{"id":"GHSA-2p49-hgcm-8545","title":"SVGO removeScripts plugin leaves some executable scripts intact","description":"### Summary\n\nSVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.\n\n### Details\n\nSVGO has a plugin for removing scripts from an SVG, which removes:\n\n- `\u003cscript\u003e` elements\n- JavaScript URIs (v4 and v3 only)\n- `on…` event handlers (v4 and v3 only)\n\nWhile SVGO is not a sanitization library, SVGO continues to maintain the plugin for those already using it for this purpose.\n\nHowever, there were two problems:\n\n- SVGO did not check namespaced/prefixed `script` elements, for example if one declared an explicit prefix for the SVG namespace ( `\u003csvg:script\u003e`) instead of using the default namespace ( `\u003cscript\u003e`), the `\u003csvg:script\u003e` tag would be left intact.\n- SVGO case sensitively matched JavaScript URIs, but it should've been case-insensitive.\n\n#### Proof of Concept\n\n```js\nimport { optimize } from 'svgo';\n\n/** Presume that this string was obtained in some other way, such as network. */\nconst original = `\n  \u003csvg xmlns=\"http://www.w3.org/2000/svg\" xmlns:svg=\"http://www.w3.org/2000/svg\" xmlns:uwu=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 100 100\" version=\"1.1\"\u003e\n    \u003ca uwu:href=\"JavaScript:(() =\u0026gt; { alert(document.cookie) })();\"\u003e\u003ctext y=\"30\"\u003euwu\u003c/text\u003e\u003c/a\u003e\n    \u003csvg:script\u003e\n      alert(document.cookie);\n    \u003c/svg:script\u003e\n  \u003c/svg\u003e\n`;\n\noptimize(original, {\n  plugins: ['removeScripts']\n});\n// Did not remove \u003csvg:script\u003e or uwu:href=\"JavaScript:…—still executed by browsers.\n```\n\n### Impact\n\nIf you run SVGO on untrusted input (e.g., user uploads to a web application) and you depended on removeScripts, then some scripts may still be present. If that SVG was then opened directly by another user on the same domain, it could invoke scripts that could read local storage or cookies.\n\nThis may affect you if you have enabled one of the following:\n\n| SVGO Version | Plugin Name |\n|---|---|\n| v4 | removeScripts |\n| v3 | removeScriptElement |\n| v2 | removeScriptElement |\n| v1 | removeScriptElement |\n\nIt's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.\n\n### Patches\n\n#### \u003e= 3.0.0, \u003c= 4.0.1\n\nSVGO patched v4.0.2 and v3.3.4. Just upgrade the dependency using your preferred package manager! For example:\n\n```sh\nyarn up svgo\n\n# or if SVGO is a nested dependency\nyarn up -R svgo\n```\n\nThe proposed fix is to improve our namespace-aware handling to explicitly act on the default namespace, SVG namespace, and XHTML namespace only. This handles all scripts that are executed by browsers, but will leave intact custom prefixes that happen to have an element called `\u003c*:script\u003e` which clients shouldn't treat as executable. \n\n#### \u003e= 2.0.0, \u003c= 2.8.2\n\nSVGO patched v2.8.3, however SVGO v2 explicitly only implements and documents that it will remove `\u003cscript\u003e` elements and nothing more. It has the namespace aware handling for tags like `\u003csvg:script\u003e` or `\u003cxhtml:script\u003e`, but has **_not_** been updated to remove JavaScript URIs or event handlers like \u003e= v3. If this is something you need, please upgrade to v4 or v3, or reach for one of the documented workarounds at the end.\n\n#### \u003e= 1.0.0, \u003c= 1.3.2\n\nSVGO v1 has been deprecated for a while now and won't be patched. Please upgrade to a more recent version! If something is preventing you from doing so, please reach out! We're happy to expand our migration guides or support you if you're having trouble.\n\n### Workarounds\n\nIf your motivation for enabling the plugin is SVG sanitization, consider reaching for a dedicated SVG sanitization tool and invoke it before passing the SVG to SVGO.","status":"published","published":"2026-07-21T19:42:04Z","modified":"2026-08-13T18:08:44Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-73650","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as \u003csvg:script\u003e and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","status":"published","published":"2026-08-13T19:17:38.46Z","modified":"2026-09-18T20:09:01.757Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-73650","title":"SVGO: removeScripts plugin leaves some executable scripts intact","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as \u003csvg:script\u003e and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","status":"published","published":"2026-08-13T18:08:36.292Z","modified":"2026-10-28T02:30:23.395222492Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184","CWE-79"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"DEBIAN-CVE-2026-73650","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as \u003csvg:script\u003e and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","status":"published","published":"2026-08-13T19:17:38.46Z","modified":"2026-10-13T11:00:07.382111677Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"GHSA-2p49-hgcm-8545","title":"SVGO removeScripts plugin leaves some executable scripts intact","description":"### Summary\n\nSVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.\n\n### Details\n\nSVGO has a plugin for removing scripts from an SVG, which removes:\n\n- `\u003cscript\u003e` elements\n- JavaScript URIs (v4 and v3 only)\n- `on…` event handlers (v4 and v3 only)\n\nWhile SVGO is not a sanitization library, SVGO continues to maintain the plugin for those already using it for this purpose.\n\nHowever, there were two problems:\n\n- SVGO did not check namespaced/prefixed `script` elements, for example if one declared an explicit prefix for the SVG namespace ( `\u003csvg:script\u003e`) instead of using the default namespace ( `\u003cscript\u003e`), the `\u003csvg:script\u003e` tag would be left intact.\n- SVGO case sensitively matched JavaScript URIs, but it should've been case-insensitive.\n\n#### Proof of Concept\n\n```js\nimport { optimize } from 'svgo';\n\n/** Presume that this string was obtained in some other way, such as network. */\nconst original = `\n  \u003csvg xmlns=\"http://www.w3.org/2000/svg\" xmlns:svg=\"http://www.w3.org/2000/svg\" xmlns:uwu=\"http://www.w3.org/1999/xlink\" viewBox=\"0 0 100 100\" version=\"1.1\"\u003e\n    \u003ca uwu:href=\"JavaScript:(() =\u0026gt; { alert(document.cookie) })();\"\u003e\u003ctext y=\"30\"\u003euwu\u003c/text\u003e\u003c/a\u003e\n    \u003csvg:script\u003e\n      alert(document.cookie);\n    \u003c/svg:script\u003e\n  \u003c/svg\u003e\n`;\n\noptimize(original, {\n  plugins: ['removeScripts']\n});\n// Did not remove \u003csvg:script\u003e or uwu:href=\"JavaScript:…—still executed by browsers.\n```\n\n### Impact\n\nIf you run SVGO on untrusted input (e.g., user uploads to a web application) and you depended on removeScripts, then some scripts may still be present. If that SVG was then opened directly by another user on the same domain, it could invoke scripts that could read local storage or cookies.\n\nThis may affect you if you have enabled one of the following:\n\n| SVGO Version | Plugin Name |\n|---|---|\n| v4 | removeScripts |\n| v3 | removeScriptElement |\n| v2 | removeScriptElement |\n| v1 | removeScriptElement |\n\nIt's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.\n\n### Patches\n\n#### \u003e= 3.0.0, \u003c= 4.0.1\n\nSVGO patched v4.0.2 and v3.3.4. Just upgrade the dependency using your preferred package manager! For example:\n\n```sh\nyarn up svgo\n\n# or if SVGO is a nested dependency\nyarn up -R svgo\n```\n\nThe proposed fix is to improve our namespace-aware handling to explicitly act on the default namespace, SVG namespace, and XHTML namespace only. This handles all scripts that are executed by browsers, but will leave intact custom prefixes that happen to have an element called `\u003c*:script\u003e` which clients shouldn't treat as executable. \n\n#### \u003e= 2.0.0, \u003c= 2.8.2\n\nSVGO patched v2.8.3, however SVGO v2 explicitly only implements and documents that it will remove `\u003cscript\u003e` elements and nothing more. It has the namespace aware handling for tags like `\u003csvg:script\u003e` or `\u003cxhtml:script\u003e`, but has **_not_** been updated to remove JavaScript URIs or event handlers like \u003e= v3. If this is something you need, please upgrade to v4 or v3, or reach for one of the documented workarounds at the end.\n\n#### \u003e= 1.0.0, \u003c= 1.3.2\n\nSVGO v1 has been deprecated for a while now and won't be patched. Please upgrade to a more recent version! If something is preventing you from doing so, please reach out! We're happy to expand our migration guides or support you if you're having trouble.\n\n### Workarounds\n\nIf your motivation for enabling the plugin is SVG sanitization, consider reaching for a dedicated SVG sanitization tool and invoke it before passing the SVG to SVGO.","status":"published","published":"2026-07-21T19:42:04Z","modified":"2026-09-10T03:51:09.939776176Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184","CWE-79"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"CLSA-2026-1784682960","title":"TuxCare security update for svgo (1 CVE)","description":"TuxCare rebuilt svgo to address 1 CVE. Fixed in 2.8.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:46Z","modified":"2026-10-15T09:47:54.072375201Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790176195","title":"TuxCare security update for svgo (1 CVE)","description":"TuxCare rebuilt svgo to address 1 CVE. Fixed in 2.8.0-tuxcare.4.","status":"published","published":"2026-09-23T15:09:55Z","modified":"2026-10-15T09:48:03.109843169Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791843793","title":"TuxCare security update for svgo (2 CVEs)","description":"TuxCare rebuilt svgo to address 2 CVEs. Fixed in 1.3.2-tuxcare.2.","status":"published","published":"2026-10-12T22:23:13Z","modified":"2026-10-15T09:47:53.551455828Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792163346","title":"TuxCare security update for svgo (3 CVEs)","description":"TuxCare rebuilt svgo to address 3 CVEs. Fixed in 4.0.1-tuxcare.1.","status":"published","published":"2026-10-16T15:09:06Z","modified":"2026-10-16T16:31:39.312979276Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792183680","title":"TuxCare security update for svgo (3 CVEs)","description":"TuxCare rebuilt svgo to address 3 CVEs. Fixed in 2.8.2-tuxcare.1.","status":"published","published":"2026-10-16T20:48:00Z","modified":"2026-10-17T01:30:06.512928741Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.960220408Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.433086957Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-NPM-CVE-2026-73650","title":"CVE-2026-73650 in svgo - Patched by Root","description":"Root has patched CVE-2026-73650 in the svgo package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-21T13:01:55Z","modified":"2026-09-21T14:15:03.340999922Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-2p49-hgcm-8545","title":"GHSA-2p49-hgcm-8545 in svgo - Patched by Root","description":"Root has patched GHSA-2p49-hgcm-8545 in the svgo package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-18T10:45:42Z","modified":"2026-09-18T11:15:04.139876167Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}