Vulnerability-Lookup

CVE-2026-84370 (GCVE-0-2026-84370)

Vulnerability from cvelistv5 – Published: 2026-09-01 20:47 – Updated: 2026-09-04 02:12

Title

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 02:11 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7885 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/svg/svgo/security/advisories/G…	x_refsource_CONFIRM
https://github.com/svg/svgo/pull/2268	x_refsource_MISC
https://github.com/svg/svgo/pull/2269	x_refsource_MISC
https://github.com/svg/svgo/pull/2272	x_refsource_MISC
https://github.com/svg/svgo/commit/0557385564a5c6…	x_refsource_MISC
https://github.com/svg/svgo/commit/3db3ef33e409a0…	x_refsource_MISC
https://github.com/svg/svgo/commit/994a9f00d79dde…	x_refsource_MISC
https://github.com/svg/svgo/releases/tag/v2.8.4	x_refsource_MISC
https://github.com/svg/svgo/releases/tag/v3.3.5	x_refsource_MISC
https://github.com/svg/svgo/releases/tag/v4.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
svg	svgo	Affected: >= 1.0.0, < 2.8.4 Affected: >= 3.0.0, < 3.3.5 Affected: >= 4.0.0, < 4.1.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:11:59.412708Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T02:12:10.574Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "svgo",
          "vendor": "svg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.8.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin\u0027s check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:47:08.707Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2268",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2268"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2269",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2269"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2272",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2272"
        },
        {
          "name": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
        },
        {
          "name": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2"
        },
        {
          "name": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v2.8.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v3.3.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v4.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w27v-7q3p-w38r",
        "discovery": "UNKNOWN"
      },
      "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84370",
    "datePublished": "2026-09-01T20:47:08.707Z",
    "dateReserved": "2026-09-01T16:27:58.129Z",
    "dateUpdated": "2026-09-04T02:12:10.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-84370",
      "date": "2026-11-14",
      "epss": "0.00525",
      "percentile": "0.45085"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "svgo",
                "vendor": "svg",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0.0, \u003c 2.8.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0, \u003c 3.3.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 4.1.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin\u0027s check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
          }
        ],
        "id": "CVE-2026-84370",
        "lastModified": "2026-09-09T21:09:13.080",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-84370",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:11:59.412708Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-01T21:18:48.217",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/pull/2268"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/pull/2269"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/pull/2272"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              },
              {
                "lang": "en",
                "value": "CWE-184"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-04T23:47:07+00:00",
      "cve": "CVE-2026-84370",
      "id": "CVE-2026-84370",
      "initial_release_date": "2026-09-01T20:47:08.707000+00:00",
      "product_status:under_investigation": "83",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "svgo: SVGO: Arbitrary script execution via incomplete executable link filtering",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84370.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-84370",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T02:11:59.412708Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T02:12:05.878Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "svgo",
              "vendor": "svg",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.0.0, \u003c 2.8.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0, \u003c 3.3.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 4.1.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin\u0027s check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-184",
                  "description": "CWE-184: Incomplete List of Disallowed Inputs",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-01T20:47:08.707Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"
            },
            {
              "name": "https://github.com/svg/svgo/pull/2268",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/pull/2268"
            },
            {
              "name": "https://github.com/svg/svgo/pull/2269",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/pull/2269"
            },
            {
              "name": "https://github.com/svg/svgo/pull/2272",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/pull/2272"
            },
            {
              "name": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
            },
            {
              "name": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2"
            },
            {
              "name": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
            },
            {
              "name": "https://github.com/svg/svgo/releases/tag/v2.8.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
            },
            {
              "name": "https://github.com/svg/svgo/releases/tag/v3.3.5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
            },
            {
              "name": "https://github.com/svg/svgo/releases/tag/v4.1.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
            }
          ],
          "source": {
            "advisory": "GHSA-w27v-7q3p-w38r",
            "discovery": "UNKNOWN"
          },
          "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-84370",
        "datePublished": "2026-09-01T20:47:08.707Z",
        "dateReserved": "2026-09-01T16:27:58.129Z",
        "dateUpdated": "2026-09-04T02:12:10.574Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1293

Vulnerability from certfr_avis - Published: 2026-10-12 - Updated: 2026-10-12

De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Elles permettent à un attaquant de provoquer un déni de service à distance et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
MongoDB	C Driver	C Driver versions antérieures à 1.30.13
MongoDB	C++ Driver	C++ Driver versions antérieures à 4.6.1
MongoDB	Python Driver	Python Driver versions antérieures à 4.18.3
MongoDB	PHP Driver	PHP Driver versions 2.1.x antérieures à 2.1.11
MongoDB	PHP Driver	PHP Driver versions 2.5.x antérieures à 2.5.4
MongoDB	PHP Driver	PHP Driver versions antérieures à 1.21.11
MongoDB	C Driver	C Driver versions 2.5.x antérieures à 2.5.6
MongoDB	libmongocrypt	libmongocrypt versions antérieures à 1.20.5
MongoDB	Go Driver	Go Driver versions antérieures à 2.9.2

References

Title

Publication Time

FKIE_CVE-2026-84370

Vulnerability from fkie_nvd - Published: 2026-09-01 21:18 - Updated: 2026-09-09 21:09

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
	security-advisories@github.com	https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2
	security-advisories@github.com	https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
	security-advisories@github.com	https://github.com/svg/svgo/pull/2268
	security-advisories@github.com	https://github.com/svg/svgo/pull/2269
	security-advisories@github.com	https://github.com/svg/svgo/pull/2272
	security-advisories@github.com	https://github.com/svg/svgo/releases/tag/v2.8.4
	security-advisories@github.com	https://github.com/svg/svgo/releases/tag/v3.3.5
	security-advisories@github.com	https://github.com/svg/svgo/releases/tag/v4.1.0
	security-advisories@github.com	https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "svgo",
          "vendor": "svg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.8.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin\u0027s check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
    }
  ],
  "id": "CVE-2026-84370",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84370",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-04T02:11:59.412708Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T21:18:48.217",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/pull/2268"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/pull/2269"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/pull/2272"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-W27V-7Q3P-W38R

Vulnerability from github – Published: 2026-09-08 21:20 – Updated: 2026-09-08 21:20

Summary

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Details

Summary

SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).

SVGO is an optimizer rather than a comprehensive sanitization library, but removeScripts is maintained for consumers that already rely on it to remove common script execution paths.

Details

Two related bypasses were present:

The plugin inspected unprefixed SVG <a> elements but did not recognize namespace-prefixed SVG anchors such as <svg:a> when the prefix was bound to the SVG namespace. Their executable href or namespaced *:href values remained intact.
The URL check did not account for ASCII tab, line-feed, or carriage-return characters embedded in a scheme. Browsers remove these characters before parsing the scheme, so values such as java	script: could remain executable after bypassing the plugin's javascript: check.

Anchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.

Impact

If an application optimized attacker-controlled SVGs with removeScripts and then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.

The plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.

Patches

Upgrade to one of the following releases for the maintained release line in use:

Release line	Patched version	Plugin
v2	2.8.4	`removeScriptElement`
v3	3.3.5	`removeScriptElement`
v4	4.1.0	`removeScripts`

The fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.

SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.

Workarounds

For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.

References

v4 fix: https://github.com/svg/svgo/pull/2268
related executable URL hardening: https://github.com/svg/svgo/pull/2263
v3 backport: https://github.com/svg/svgo/pull/2269
v2 backport: https://github.com/svg/svgo/pull/2272
v4.1.0 release: https://github.com/svg/svgo/releases/tag/v4.1.0
v3.3.5 release: https://github.com/svg/svgo/releases/tag/v3.3.5
v2.8.4 release: https://github.com/svg/svgo/releases/tag/v2.8.4

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "svgo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "svgo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "svgo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84370"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T21:20:28Z",
    "nvd_published_at": "2026-09-01T21:18:48Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nSVGO\u0027s opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).\n\nSVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths.\n\n## Details\n\nTwo related bypasses were present:\n\n1. The plugin inspected unprefixed SVG `\u003ca\u003e` elements but did not recognize namespace-prefixed SVG anchors such as `\u003csvg:a\u003e` when the prefix was bound to the SVG namespace. Their executable `href` or namespaced `*:href` values remained intact.\n2. The URL check did not account for ASCII tab, line-feed, or carriage-return characters embedded in a scheme. Browsers remove these characters before parsing the scheme, so values such as `java\u0026#9;script:` could remain executable after bypassing the plugin\u0027s `javascript:` check.\n\nAnchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.\n\n## Impact\n\nIf an application optimized attacker-controlled SVGs with `removeScripts` and then served the result in an active browser context, a victim could follow a link that executes script in the SVG\u0027s origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.\n\nThe plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.\n\n## Patches\n\nUpgrade to one of the following releases for the maintained release line in use:\n\n| Release line | Patched version | Plugin |\n| --- | --- | --- |\n| v2 | 2.8.4 | `removeScriptElement` |\n| v3 | 3.3.5 | `removeScriptElement` |\n| v4 | 4.1.0 | `removeScripts` |\n\nThe fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.\n\nSVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.\n\n## Workarounds\n\nFor hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.\n\n## References\n\n- v4 fix: https://github.com/svg/svgo/pull/2268\n- related executable URL hardening: https://github.com/svg/svgo/pull/2263\n- v3 backport: https://github.com/svg/svgo/pull/2269\n- v2 backport: https://github.com/svg/svgo/pull/2272\n- v4.1.0 release: https://github.com/svg/svgo/releases/tag/v4.1.0\n- v3.3.5 release: https://github.com/svg/svgo/releases/tag/v3.3.5\n- v2.8.4 release: https://github.com/svg/svgo/releases/tag/v2.8.4",
  "id": "GHSA-w27v-7q3p-w38r",
  "modified": "2026-09-08T21:20:28Z",
  "published": "2026-09-08T21:20:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/pull/2268"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/pull/2269"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/pull/2272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/svg/svgo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SVGO: removeScripts allows executable links through namespace and control-character bypasses"
}

OPENSUSE-SU-2026:12070-1

Vulnerability from csaf_opensuse - Published: 2026-10-06 00:00 - Updated: 2026-10-07 08:42

Summary

velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media

Severity

Moderate

Scope

40 vulnerabilities in this advisory, including CVE-2026-84370.

CVE-2026-84370

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-84370 (GCVE-0-2026-84370)

CERTFR-2026-AVI-1293

Solutions

FKIE_CVE-2026-84370

GHSA-W27V-7Q3P-W38R

Summary

Details

Impact

Patches

Workarounds

References

OPENSUSE-SU-2026:12070-1

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour