CVE-2026-84369

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9

Description The removeScripts plugin (known as removeScriptElement in versions 2 and 3), implemented in plugins/removeScripts.js, fails to inspect executable HTML content within SVG foreignObject elements. This allows event-handler attributes like onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes to persist in attacker-controlled SVG input. If an application relies solely on this plugin and serves the optimized SVG in an active browser context, it can lead to script execution in the viewer's origin, data exposure, content modification, or unauthorized actions performed as the victim.

Recommendations Update to version 2.8.4 Update to version 3.3.5 Update to version 4.1.0