CVE-2026-84369: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
SVGO’s opt-in removeScripts plugin did not inspect executable HTML content inside SVG <foreignObject> elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS).
SVGO is an optimizer rather than a comprehensive sanitization library, but removeScripts is maintained for consumers that already rely on it to remove common script execution paths.
References
- github.com/advisories/GHSA-4vpr-x523-8j87
- github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
- github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
- github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327
- github.com/svg/svgo/pull/2264
- github.com/svg/svgo/pull/2269
- github.com/svg/svgo/pull/2272
- github.com/svg/svgo/releases/tag/v2.8.4
- github.com/svg/svgo/releases/tag/v3.3.5
- github.com/svg/svgo/releases/tag/v4.1.0
- github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87
- nvd.nist.gov/vuln/detail/CVE-2026-84369
Code Behaviors & Features
Detect and mitigate CVE-2026-84369 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →