CVE-2026-73650

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.2 SVGO versions 3.0.0 through 3.3.3 SVGO versions 4.0.0 through 4.0.1

Description The removeScripts plugin (known as removeScriptElement in versions 1 through 3) fails to remove namespaced or prefixed script elements, such as <svg:script>, and performs case-sensitive matching for JavaScript URIs in versions 3 and 4. This allows executable content to remain in optimized SVG files. Applications processing untrusted SVG input with this plugin enabled may allow scripts to execute when a user opens the file, potentially exposing cookies or local storage.

Recommendations Update to version 2.8.3. Update to version 3.3.4. Update to version 4.0.2.