CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

• CWE-79

• https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
• https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
• https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327
• https://github.com/svg/svgo/pull/2264
• https://github.com/svg/svgo/pull/2269
• https://github.com/svg/svgo/pull/2272
• https://github.com/svg/svgo/releases/tag/v2.8.4
• https://github.com/svg/svgo/releases/tag/v3.3.5
• https://github.com/svg/svgo/releases/tag/v4.1.0
• https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87

Published

Sep 1, 2026

Last Modified

Sep 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84363Hono is a Web application framework that provides support fo…5.9
• CVE-2026-84364Hono is a Web application framework that provides support fo…5.3
• CVE-2026-84365Hono is a Web application framework that provides support fo…6.5
• CVE-2026-84366Scrapy is a high-level web crawling and scraping framework f…7.4
• CVE-2026-84367joi is a schema description language and data validator for …3.7
• CVE-2026-84368joi is a schema description language and data validator for …3.7
• CVE-2026-84370SVGO, short for SVG Optimizer, is a Node.js library and comm…8.2
• CVE-2026-84371ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2
• CVE-2026-8441The WP Review Slider Pro plugin for WordPress is vulnerable …7.5
• CVE-2026-8442The WP Review Slider Pro plugin for WordPress is vulnerable …8.1
• CVE-2026-8443The WP Review Slider Pro plugin for WordPress is vulnerable …8.8