CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

• CWE-79
• CWE-184

• https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
• https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2
• https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
• https://github.com/svg/svgo/pull/2268
• https://github.com/svg/svgo/pull/2269
• https://github.com/svg/svgo/pull/2272
• https://github.com/svg/svgo/releases/tag/v2.8.4
• https://github.com/svg/svgo/releases/tag/v3.3.5
• https://github.com/svg/svgo/releases/tag/v4.1.0
• https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r

Published

Sep 1, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84364Hono is a Web application framework that provides support fo…5.3
• CVE-2026-84365Hono is a Web application framework that provides support fo…6.5
• CVE-2026-84366Scrapy is a high-level web crawling and scraping framework f…7.4
• CVE-2026-84367joi is a schema description language and data validator for …3.7
• CVE-2026-84368joi is a schema description language and data validator for …3.7
• CVE-2026-84369SVGO, short for SVG Optimizer, is a Node.js library and comm…6.1
• CVE-2026-84371ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-84372Predis is a flexible and feature-complete Redis and Valkey c…9.8
• CVE-2026-84373Vitest is a testing framework powered by Vite. From 2.1.0 un…5.9
• CVE-2026-84374Laravel Excel provides supercharged Excel exports and import…7.5
• CVE-2026-84375js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 u…7.5
• CVE-2026-84376Astro is a web framework for content-driven websites. Prior …6.3