CVE-2026-84370

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9

Description The removeScripts plugin (known as removeScriptElement in versions 2 and 3) incompletely filters executable links within plugins/removeScripts.js and lib/svgo/tools.js. The plugin fails to recognize namespace-prefixed SVG anchor elements, such as svg:a with href or namespaced *:href values. Additionally, it does not remove ASCII tab, line-feed, or carriage-return characters before validating URL schemes. Since browsers strip these characters before parsing, an executable link can bypass the filter. If an application processes malicious SVG input and serves it in an active browser context, a user interacting with the link could execute scripts in the SVG origin, leading to data exposure, content modification, or unauthorized actions.

Recommendations Update to version 2.8.4 Update to version 3.3.5 Update to version 4.1.0