SVGO: removeScripts allows executable links through namespace and control-character bypasses
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 26 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| svg | svgo | 1.0.0 to before 2.8.4; 3.0.0 to before 3.3.5; 4.0.0 to before 4.1.0 | 2.8.4, 3.3.5, 4.1.0 | Patch available | CNA |
| — | svgo (npm) | 1.0.0 to before 2.8.4 | 2.8.4 | Patch available | GHSA-w27v-7q3p-w38r |
| — | svgo (npm) | 3.0.0 to before 3.3.5 | 3.3.5 | Patch available | GHSA-w27v-7q3p-w38r |
| — | svgo (npm) | 4.0.0 to before 4.1.0 | 4.1.0 | Patch available | GHSA-w27v-7q3p-w38r |
- svgo Vendorsvg Affected 1.0.0 to before 2.8.4; 3.0.0 to before 3.3.5; 4.0.0 to before 4.1.0 Fixed in 2.8.4, 3.3.5, 4.1.0 Patch available CNA
- svgo (npm) Vendor— Affected 1.0.0 to before 2.8.4 Fixed in 2.8.4 Patch available GHSA-w27v-7q3p-w38r
- svgo (npm) Vendor— Affected 3.0.0 to before 3.3.5 Fixed in 3.3.5 Patch available GHSA-w27v-7q3p-w38r
- svgo (npm) Vendor— Affected 4.0.0 to before 4.1.0 Fixed in 4.1.0 Patch available GHSA-w27v-7q3p-w38r
Remediation
- Fix · CNA svgo (svg) Fixed in 2.8.4, 3.3.5, 4.1.0
- Fix · GHSA-w27v-7q3p-w38r svgo (npm) Fixed in 2.8.4 Advisory →
- Fix · GHSA-w27v-7q3p-w38r svgo (npm) Fixed in 3.3.5 Advisory →
- Fix · GHSA-w27v-7q3p-w38r svgo (npm) Fixed in 4.1.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | — |
| OpenShift Pipelines | Affected | — |
| OpenShift Service Mesh 3 | Affected | — |
| Red Hat 3scale API Management Platform 2 | Affected | — |
| Red Hat AMQ Broker 7 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | — |
| Red Hat Build of Podman Desktop | Affected | — |
| Red Hat Ceph Storage 4 | Affected | — |
| Red Hat Ceph Storage 9 | Affected | — |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Data Grid 8 | Affected | — |
| Red Hat Developer Hub 1 | Affected | — |
| Red Hat Discovery 2 | Affected | — |
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 7 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | — |
| Red Hat Fuse 7 | Affected | — |
| Red Hat Hardened Images | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat Quay 3 | Affected | — |
| Red Hat Single Sign-On 7 | Affected | — |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | — |
| Self-service automation portal 2 | Affected | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84370
- 2026-10-03 Alias added: GHSA-w27v-7q3p-w38r
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-06 CVSS score added · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
Other 11
- https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r
- https://github.com/svg/svgo/pull/2268
- https://github.com/svg/svgo/pull/2269
- https://github.com/svg/svgo/pull/2272
- https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
- https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2
- https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
- https://github.com/svg/svgo/releases/tag/v2.8.4
- https://github.com/svg/svgo/releases/tag/v3.3.5
- https://github.com/svg/svgo/releases/tag/v4.1.0
- https://github.com/svg/svgo
More svg vulnerabilities
- TI-2026-51734 SVGO: removeScripts plugin leaves some executable scripts intact CVSS 3.1HIGH 8.2
- TI-2026-57980 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-84370 · CVE Program
- CVE-2026-84370 · NVD
- FIRST EPSS
- GHSA-w27v-7q3p-w38r · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84370 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences