CVE-2026-84370: SVGO: removeScripts allows executable links through namespace and control-character bypasses
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced :href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SVGO (removeScripts plugin)to a version that resolves this vulnerability.Fixed in 2.8.4 - Upgrade
Upgrade
SVGO (removeScripts plugin)to a version that resolves this vulnerability.Fixed in 3.3.5 - Upgrade
Upgrade
SVGO (removeScripts plugin)to a version that resolves this vulnerability.Fixed in 4.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications are exposed if they process attacker-controlled SVG files with SVGO's opt-in removeScripts plugin (called removeScriptElement in versions 2 and 3) and then serve the optimized SVG in an active browser context. Exploitation also requires a victim to activate the surviving link.
Is the default SVGO configuration affected?
The affected functionality is an opt-in plugin. The provided information identifies exposure when removeScripts or removeScriptElement is enabled; it does not state that default configurations enable it.
What input patterns can bypass the plugin's filtering?
Namespace-prefixed SVG anchors such as svg:a with href, namespaced *:href attributes, and URL schemes containing ASCII tab, line-feed, or carriage-return characters can bypass the checks. Browsers remove those control characters before interpreting the URL scheme.
What should be done if an upgrade is not immediately possible?
Do not rely on the affected plugin to sanitize attacker-controlled SVGs before serving them in an active browser context. Prevent untrusted SVG uploads from being served as active browser content until a fixed version can be deployed.
Which versions contain fixes?
Fixed versions are 2.8.4, 3.3.5, and 4.1.0. The issue affects versions starting at 1.0.0 up to those fixed releases.