CVE-2026-84369

Received Received - Intake

Stored XSS in SVGO via Unsanitized SVG ForeignObject Elements

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84369

Affected Vendors & Products

Vendor	Product	Version / Range
svg_optimiser	svgo	to 2.8.4 (exc)
svg_optimiser	svgo	From 2.8.4 (inc)
svg_optimiser	svgo	From 3.3.5 (inc)
svg_optimiser	svgo	From 4.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SVGO is a tool for optimizing SVG files. Between versions 1.0.0 and 2.8.4, 3.3.5, and 4.1.0, its removeScripts plugin failed to remove executable HTML content inside SVG foreignObject elements. This allowed malicious SVG files to retain event-handler attributes like onload or executable URLs in attributes such as href or src. When processed and served in a browser, these SVGs could execute scripts in the viewer's context.

Detection Guidance

Detecting this vulnerability requires checking if your SVGO version is affected. Run 'npm list svgo' or 'svgo --version' to identify the installed version. If the version is between 1.0.0 and 2.8.3, 3.0.0 and 3.3.4, or 4.0.0 and 4.0.9, the system is vulnerable.

Impact Analysis

If you use an affected SVGO version to process user-uploaded SVGs, attackers could embed malicious scripts in SVG files. When viewed in a browser, these scripts could steal data, modify content, or perform actions on your behalf, potentially leading to account compromise or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected SVGO versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade SVGO to version 2.8.4, 3.3.5, or 4.1.0 or later immediately. If upgrading is not possible, disable the removeScripts plugin or avoid using SVGO as the sole protection for untrusted SVG files.

Hi! I’m here to help you understand CVE-2026-84369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70