{"id":"CVE-2026-84370","aliases":["CLSA-2026-1788978124","CLSA-2026-1788978264","CLSA-2026-1791843793","CLSA-2026-1792163346","CLSA-2026-1792183680","CLSA-2026-1793045772","DEBIAN-CVE-2026-84370","EUVD-2026-69653","GHSA-w27v-7q3p-w38r","ROOT-APP-NPM-CVE-2026-84370","openSUSE-SU-2026:12070-1"],"status":"published","title":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00525,"percentile":0.45003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184","CWE-79"],"published":"2026-09-01T20:47:08Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"npm","package":"svgo","fixed_in":["2.8.4","3.3.5","4.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-svgo","fixed_in":["3.3.5+ds-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"svgo","fixed_in":["3.3.3-aikido.3","3.3.4-aikido.1","2.8.0-aikido.5","3.3.2-aikido.3","1.3.2-aikido.4","1.3.0-aikido.3","2.8.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/svgo","fixed_in":["3.3.3-root.io.3","3.3.4-root.io.1","2.8.0-root.io.5","3.3.2-root.io.3","1.3.2-root.io.4","1.3.0-root.io.3","2.8.3-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.8.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.2-tuxcare.0"},{"fixed":"4.0.2-tuxcare.1"}]}],"versions":["4.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0-tuxcare.0"},{"fixed":"2.8.0-tuxcare.3"}]}],"versions":["2.8.0","2.8.0-tuxcare.1","2.8.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.2-tuxcare.0"},{"fixed":"1.3.2-tuxcare.2"}]}],"versions":["1.3.2","1.3.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.1"}]}],"versions":["4.0.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.2-tuxcare.0"},{"fixed":"2.8.2-tuxcare.1"}]}],"versions":["2.8.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.3-tuxcare.0"},{"fixed":"2.8.3-tuxcare.1"}]}],"versions":["2.8.3"],"bundled":2},{"source":"osv","ecosystem":"Debian:14","package":"node-svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5+ds-1"}]}],"versions":["3.3.2+ds-1"]},{"source":"osv","ecosystem":"npm","package":"svgo","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"2.8.4"}]}]},{"source":"osv","ecosystem":"npm","package":"svgo","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.3.5"}]}]},{"source":"osv","ecosystem":"npm","package":"svgo","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-aikido.3"},{"fixed":"3.3.4-aikido.1"},{"fixed":"2.8.0-aikido.5"},{"fixed":"3.3.2-aikido.3"},{"fixed":"1.3.2-aikido.4"},{"fixed":"1.3.0-aikido.3"},{"fixed":"2.8.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/svgo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-root.io.3"},{"fixed":"3.3.4-root.io.1"},{"fixed":"2.8.0-root.io.5"},{"fixed":"3.3.2-root.io.3"},{"fixed":"1.3.2-root.io.4"},{"fixed":"1.3.0-root.io.3"},{"fixed":"2.8.3-root.io.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.7.0.git145.b60ef1146-1.1"}]}],"bundled":40}],"products":[{"vendor":"svg","product":"svgo"}],"references":[{"url":"https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/svg/svgo/pull/2268","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/pull/2269","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/pull/2272","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/svg/svgo/releases/tag/v2.8.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/svg/svgo/releases/tag/v3.3.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/svg/svgo/releases/tag/v4.1.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84370","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w27v-7q3p-w38r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84370.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84370","tags":["advisory"]},{"url":"https://github.com/svg/svgo","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-84370","title":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","status":"published","published":"2026-09-01T20:47:08.707Z","modified":"2026-09-04T02:12:10.574Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-69653","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","status":"published","published":"2026-09-01T20:47:08Z","modified":"2026-09-04T02:12:10Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:13.160542Z"}],"ghsa":[{"id":"GHSA-w27v-7q3p-w38r","title":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","description":"## Summary\n\nSVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).\n\nSVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths.\n\n## Details\n\nTwo related bypasses were present:\n\n1. The plugin inspected unprefixed SVG `\u003ca\u003e` elements but did not recognize namespace-prefixed SVG anchors such as `\u003csvg:a\u003e` when the prefix was bound to the SVG namespace. Their executable `href` or namespaced `*:href` values remained intact.\n2. The URL check did not account for ASCII tab, line-feed, or carriage-return characters embedded in a scheme. Browsers remove these characters before parsing the scheme, so values such as `java\u0026#9;script:` could remain executable after bypassing the plugin's `javascript:` check.\n\nAnchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.\n\n## Impact\n\nIf an application optimized attacker-controlled SVGs with `removeScripts` and then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.\n\nThe plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.\n\n## Patches\n\nUpgrade to one of the following releases for the maintained release line in use:\n\n| Release line | Patched version | Plugin |\n| --- | --- | --- |\n| v2 | 2.8.4 | `removeScriptElement` |\n| v3 | 3.3.5 | `removeScriptElement` |\n| v4 | 4.1.0 | `removeScripts` |\n\nThe fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.\n\nSVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.\n\n## Workarounds\n\nFor hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.\n\n## References\n\n- v4 fix: https://github.com/svg/svgo/pull/2268\n- related executable URL hardening: https://github.com/svg/svgo/pull/2263\n- v3 backport: https://github.com/svg/svgo/pull/2269\n- v2 backport: https://github.com/svg/svgo/pull/2272\n- v4.1.0 release: https://github.com/svg/svgo/releases/tag/v4.1.0\n- v3.3.5 release: https://github.com/svg/svgo/releases/tag/v3.3.5\n- v2.8.4 release: https://github.com/svg/svgo/releases/tag/v2.8.4","status":"published","published":"2026-09-08T21:20:28Z","modified":"2026-10-26T23:52:17Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-84370","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","status":"published","published":"2026-09-01T21:18:48.217Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"CVE-2026-84370","title":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","status":"published","published":"2026-09-01T20:47:08.707Z","modified":"2026-10-28T02:31:05.452374121Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184","CWE-79"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-84370","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","status":"published","published":"2026-09-01T21:18:48.217Z","modified":"2026-10-13T11:00:07.375993234Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-w27v-7q3p-w38r","title":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","description":"## Summary\n\nSVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).\n\nSVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths.\n\n## Details\n\nTwo related bypasses were present:\n\n1. The plugin inspected unprefixed SVG `\u003ca\u003e` elements but did not recognize namespace-prefixed SVG anchors such as `\u003csvg:a\u003e` when the prefix was bound to the SVG namespace. Their executable `href` or namespaced `*:href` values remained intact.\n2. The URL check did not account for ASCII tab, line-feed, or carriage-return characters embedded in a scheme. Browsers remove these characters before parsing the scheme, so values such as `java\u0026#9;script:` could remain executable after bypassing the plugin's `javascript:` check.\n\nAnchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.\n\n## Impact\n\nIf an application optimized attacker-controlled SVGs with `removeScripts` and then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.\n\nThe plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.\n\n## Patches\n\nUpgrade to one of the following releases for the maintained release line in use:\n\n| Release line | Patched version | Plugin |\n| --- | --- | --- |\n| v2 | 2.8.4 | `removeScriptElement` |\n| v3 | 3.3.5 | `removeScriptElement` |\n| v4 | 4.1.0 | `removeScripts` |\n\nThe fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.\n\nSVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.\n\n## Workarounds\n\nFor hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.\n\n## References\n\n- v4 fix: https://github.com/svg/svgo/pull/2268\n- related executable URL hardening: https://github.com/svg/svgo/pull/2263\n- v3 backport: https://github.com/svg/svgo/pull/2269\n- v2 backport: https://github.com/svg/svgo/pull/2272\n- v4.1.0 release: https://github.com/svg/svgo/releases/tag/v4.1.0\n- v3.3.5 release: https://github.com/svg/svgo/releases/tag/v3.3.5\n- v2.8.4 release: https://github.com/svg/svgo/releases/tag/v2.8.4","status":"published","published":"2026-09-08T21:20:28Z","modified":"2026-09-08T21:30:04.76935463Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184","CWE-79"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"CLSA-2026-1788978124","title":"TuxCare security update for svgo (2 CVEs)","description":"TuxCare rebuilt svgo to address 2 CVEs. Fixed in 4.0.2-tuxcare.1.","status":"published","published":"2026-09-09T18:22:04Z","modified":"2026-10-15T09:47:55.485348142Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788978264","title":"TuxCare security update for svgo (2 CVEs)","description":"TuxCare rebuilt svgo to address 2 CVEs. Fixed in 2.8.0-tuxcare.3.","status":"published","published":"2026-09-09T18:24:24Z","modified":"2026-10-15T09:47:55.61178896Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791843793","title":"TuxCare security update for svgo (2 CVEs)","description":"TuxCare rebuilt svgo to address 2 CVEs. Fixed in 1.3.2-tuxcare.2.","status":"published","published":"2026-10-12T22:23:13Z","modified":"2026-10-15T09:47:53.551455828Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792163346","title":"TuxCare security update for svgo (3 CVEs)","description":"TuxCare rebuilt svgo to address 3 CVEs. Fixed in 4.0.1-tuxcare.1.","status":"published","published":"2026-10-16T15:09:06Z","modified":"2026-10-16T16:31:39.312979276Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792183680","title":"TuxCare security update for svgo (3 CVEs)","description":"TuxCare rebuilt svgo to address 3 CVEs. Fixed in 2.8.2-tuxcare.1.","status":"published","published":"2026-10-16T20:48:00Z","modified":"2026-10-17T01:30:06.512928741Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1793045772","title":"TuxCare security update for svgo (2 CVEs)","description":"TuxCare rebuilt svgo to address 2 CVEs. Fixed in 2.8.3-tuxcare.1.","status":"published","published":"2026-10-26T20:16:12Z","modified":"2026-10-27T01:45:03.469784232Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.433086957Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-NPM-CVE-2026-84370","title":"CVE-2026-84370 in svgo - Patched by Root","description":"Root has patched CVE-2026-84370 in the svgo package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-21T13:01:55Z","modified":"2026-09-21T14:15:03.35132848Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}