CVE-2026-84370

Received Received - Intake

Stored XSS in SVGO via Incomplete removeScripts Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84370

Affected Vendors & Products

Vendor	Product	Version / Range
svg_optimiser	svgo	to 2.8.4 (inc)
svg_optimiser	svgo	2.8.4
svg_optimiser	svgo	3.3.5
svg_optimiser	svgo	4.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SVGO is a tool for optimizing SVG files. A vulnerability in versions 1.0.0 to 2.8.3, 3.0.0 to 3.3.4, and 4.0.0 to 4.0.9 affects the removeScripts plugin. It fails to properly filter executable links in SVG files due to incomplete handling of namespace-prefixed anchor elements and whitespace characters in URLs. This allows malicious scripts to remain in optimized SVGs.

Detection Guidance

To detect this vulnerability, inspect SVG files processed by SVGO versions before 2.8.4, 3.3.5, or 4.1.0 for remaining executable links. Check for namespace-prefixed anchor elements like svg:a with href or namespaced *:href values. Also verify if ASCII tab, line-feed, or carriage-return characters exist before URL schemes in the output.

Impact Analysis

If you process SVG files with vulnerable SVGO versions and serve the output in a browser, attackers could embed malicious scripts. Clicking a crafted link in the SVG could execute arbitrary code in your browser, steal data, modify content, or perform actions on your behalf within the SVG's origin.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable SVGO versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade SVGO to version 2.8.4, 3.3.5, or 4.1.0 or later to fix the incomplete filtering in the removeScripts plugin. If using the removeScripts plugin, ensure it is updated and verify that executable links are properly removed from SVG files.

Hi! I’m here to help you understand CVE-2026-84370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70