SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 25 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| svg | svgo | 1.0.0 to before 2.8.4; 3.0.0 to before 3.3.5; 4.0.0 to before 4.1.0 | 2.8.4, 3.3.5, 4.1.0 | Patch available | CNA |
| — | svgo (npm) | 1.0.0 to before 2.8.4 | 2.8.4 | Patch available | GHSA-4vpr-x523-8j87 |
| — | svgo (npm) | 3.0.0 to before 3.3.5 | 3.3.5 | Patch available | GHSA-4vpr-x523-8j87 |
| — | svgo (npm) | 4.0.0 to before 4.1.0 | 4.1.0 | Patch available | GHSA-4vpr-x523-8j87 |
- svgo Vendorsvg Affected 1.0.0 to before 2.8.4; 3.0.0 to before 3.3.5; 4.0.0 to before 4.1.0 Fixed in 2.8.4, 3.3.5, 4.1.0 Patch available CNA
- svgo (npm) Vendor— Affected 1.0.0 to before 2.8.4 Fixed in 2.8.4 Patch available GHSA-4vpr-x523-8j87
- svgo (npm) Vendor— Affected 3.0.0 to before 3.3.5 Fixed in 3.3.5 Patch available GHSA-4vpr-x523-8j87
- svgo (npm) Vendor— Affected 4.0.0 to before 4.1.0 Fixed in 4.1.0 Patch available GHSA-4vpr-x523-8j87
Remediation
- Fix · CNA svgo (svg) Fixed in 2.8.4, 3.3.5, 4.1.0
- Fix · GHSA-4vpr-x523-8j87 svgo (npm) Fixed in 2.8.4 Advisory →
- Fix · GHSA-4vpr-x523-8j87 svgo (npm) Fixed in 3.3.5 Advisory →
- Fix · GHSA-4vpr-x523-8j87 svgo (npm) Fixed in 4.1.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | — |
| OpenShift Pipelines | Affected | — |
| OpenShift Service Mesh 3 | Affected | — |
| Red Hat 3scale API Management Platform 2 | Affected | — |
| Red Hat AMQ Broker 7 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | — |
| Red Hat Build of Podman Desktop | Affected | — |
| Red Hat Ceph Storage 9 | Affected | — |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Data Grid 8 | Affected | — |
| Red Hat Developer Hub 1 | Affected | — |
| Red Hat Discovery 2 | Affected | — |
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 7 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | — |
| Red Hat Fuse 7 | Affected | — |
| Red Hat Hardened Images | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat Quay 3 | Affected | — |
| Red Hat Single Sign-On 7 | Affected | — |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | — |
| Self-service automation portal 2 | Affected | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84369
- 2026-10-03 Alias added: GHSA-4vpr-x523-8j87
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
Other 11
- https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87
- https://github.com/svg/svgo/pull/2264
- https://github.com/svg/svgo/pull/2269
- https://github.com/svg/svgo/pull/2272
- https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
- https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
- https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327
- https://github.com/svg/svgo/releases/tag/v2.8.4
- https://github.com/svg/svgo/releases/tag/v3.3.5
- https://github.com/svg/svgo/releases/tag/v4.1.0
- https://github.com/svg/svgo
More svg vulnerabilities
- TI-2026-51734 SVGO: removeScripts plugin leaves some executable scripts intact CVSS 3.1HIGH 8.2
- TI-2026-57981 SVGO: removeScripts allows executable links through namespace and control-character bypasses CVSS 3.1HIGH 8.2
Sources
- CVE-2026-84369 · CVE Program
- CVE-2026-84369 · NVD
- FIRST EPSS
- GHSA-4vpr-x523-8j87 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84369 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences