CVE-2026-84369: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when they process attacker-controlled SVGs with SVGO's opt-in removeScripts plugin as the only safeguard and then serve the optimized SVG in an active browser context. The issue affects versions from 1.0.0 up to, but not including, 2.8.4, 3.3.5, and 4.1.0.
What does an attacker need to exploit it?
An attacker needs to supply an SVG that is processed by the affected plugin and later rendered in an active browser context. The malicious content can be placed in HTML within an SVG foreignObject element, including event-handler attributes, srcdoc documents, or executable URLs in action, data, formaction, href, or src attributes.
Are default SVGO configurations affected?
The vulnerable removeScripts plugin is opt-in, so the provided data does not indicate that installations not using this plugin are affected by this specific flaw. Exposure specifically depends on relying on the plugin as the only protection for untrusted SVG input.
What should be done if upgrades cannot happen immediately?
Do not rely on removeScripts alone to sanitize attacker-controlled SVG files. Avoid serving optimized untrusted SVGs in an active browser context until upgrading to 2.8.4, 3.3.5, or 4.1.0.
How can teams determine whether they may already be affected?
Check whether the application uses SVGO versions earlier than 2.8.4, 3.3.5, or 4.1.0 and enables removeScripts or removeScriptElement. Then determine whether untrusted SVG input can contain foreignObject elements and is served where a browser may execute active content under the viewer's origin.