GHSA-2p49-hgcm-8545: SVGO removeScripts plugin leaves some executable scripts intact
(updated )
SVGO’s removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.
References
- github.com/advisories/GHSA-2p49-hgcm-8545
- github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
- github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
- github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
- github.com/svg/svgo/releases/tag/v2.8.3
- github.com/svg/svgo/releases/tag/v3.3.4
- github.com/svg/svgo/releases/tag/v4.0.2
- github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545
- nvd.nist.gov/vuln/detail/CVE-2026-73650
Code Behaviors & Features
Detect and mitigate GHSA-2p49-hgcm-8545 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →