CVE-2026-73650

Received Received - Intake

SVGO removeScripts Plugin Script Execution Vulnerability

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73650

EUVD

EUVD-2026-58193

Affected Vendors & Products

Vendor	Product	Version / Range
svg_optimiser	svgo	to 2.8.3 (exc)
svg_optimiser	svgo	2.8.3
svg_optimiser	svgo	3.3.4
svg_optimiser	svgo	4.0.2
svg	svgo	to 2.8.3 (inc)
svg	svgo	to 3.3.4 (inc)
svg	svgo	to 4.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in SVGO affects the removeScripts plugin, which is supposed to remove executable scripts from SVG files to prevent XSS attacks. However, it fails to remove scripts in certain cases, such as when scripts are defined with namespaced elements like <svg:script> or when JavaScript URIs are matched case-insensitively. This leaves malicious scripts intact in optimized SVGs.

Detection Guidance

To detect this vulnerability, inspect SVG files processed by SVGO versions before 2.8.3, 3.3.4, or 4.0.2 for remaining script elements or JavaScript URIs. Check for namespaced scripts like <svg:script> or case variations of 'javascript:' in attributes. Use commands like 'grep -r "<svg:script>" /path/to/svgs' or 'grep -ri "javascript:" /path/to/svgs' to search for suspicious patterns.

Impact Analysis

If you process untrusted SVG files with a vulnerable SVGO version and serve the results, attackers could execute scripts when users open the SVG. This could expose sensitive data like cookies or local storage, leading to potential data theft or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable SVGO versions may face compliance violations if user data is exposed due to this flaw.

Mitigation Strategies

Upgrade SVGO to versions 2.8.3, 3.3.4, or 4.0.2 or later. If using older versions, apply patches from the commits addressing namespace handling and case-insensitive URI matching. Avoid processing untrusted SVG files with the removeScripts plugin enabled until patched.

Hi! I’m here to help you understand CVE-2026-73650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70