Vulnerability-Lookup

GHSA-4VPR-X523-8J87

Vulnerability from github – Published: 2026-09-08 21:20 – Updated: 2026-09-08 21:20

Summary

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Details

Summary

SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG <foreignObject> elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS).

SVGO is an optimizer rather than a comprehensive sanitization library, but removeScripts is maintained for consumers that already rely on it to remove common script execution paths.

Details

Although the plugin removed SVG and XHTML <script> elements, it left other HTML execution paths inside <foreignObject> unchanged. These included:

event-handler attributes such as onload and onbeforetoggle;
srcdoc documents, including on <iframe> elements;
executable URLs in HTML attributes such as action, data, formaction, href, and src.

An attacker could place one of these payloads in an SVG. If an application optimized the untrusted SVG with removeScripts and then served the result in an active browser context, the payload could execute in the viewer's origin.

Impact

Successful exploitation could allow script execution in the context where the optimized SVG is rendered. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.

The plugin is opt-in, so consumers that do not enable removeScripts are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.

Patches

Upgrade to one of the following releases for the maintained release line in use:

Release line	Patched version	Plugin
v2	2.8.4	`removeScriptElement`
v3	3.3.5	`removeScriptElement`
v4	4.1.0	`removeScripts`

The fix preserves visual HTML inside SVG <foreignObject> elements while removing event attributes, srcdoc, and executable URL values from active HTML URL attributes.

SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.

Workarounds

For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. As defense in depth, applications can reject or remove <foreignObject> content and avoid serving user-controlled SVGs in an active same-origin context.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "svgo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "svgo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "svgo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84369"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T21:20:05Z",
    "nvd_published_at": "2026-09-01T21:18:48Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nSVGO\u0027s opt-in `removeScripts` plugin did not inspect executable HTML content inside SVG `\u003cforeignObject\u003e` elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS).\n\nSVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths.\n\n## Details\n\nAlthough the plugin removed SVG and XHTML `\u003cscript\u003e` elements, it left other HTML execution paths inside `\u003cforeignObject\u003e` unchanged. These included:\n\n- event-handler attributes such as `onload` and `onbeforetoggle`;\n- `srcdoc` documents, including on `\u003ciframe\u003e` elements;\n- executable URLs in HTML attributes such as `action`, `data`, `formaction`, `href`, and `src`.\n\nAn attacker could place one of these payloads in an SVG. If an application optimized the untrusted SVG with `removeScripts` and then served the result in an active browser context, the payload could execute in the viewer\u0027s origin.\n\n## Impact\n\nSuccessful exploitation could allow script execution in the context where the optimized SVG is rendered. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.\n\nThe plugin is opt-in, so consumers that do not enable `removeScripts` are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.\n\n## Patches\n\nUpgrade to one of the following releases for the maintained release line in use:\n\n| Release line | Patched version | Plugin |\n| --- | --- | --- |\n| v2 | 2.8.4 | `removeScriptElement` |\n| v3 | 3.3.5 | `removeScriptElement` |\n| v4 | 4.1.0 | `removeScripts` |\n\nThe fix preserves visual HTML inside SVG `\u003cforeignObject\u003e` elements while removing event attributes, `srcdoc`, and executable URL values from active HTML URL attributes.\n\nSVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.\n\n## Workarounds\n\nFor hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. As defense in depth, applications can reject or remove `\u003cforeignObject\u003e` content and avoid serving user-controlled SVGs in an active same-origin context.",
  "id": "GHSA-4vpr-x523-8j87",
  "modified": "2026-09-08T21:20:05Z",
  "published": "2026-09-08T21:20:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84369"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/pull/2264"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/pull/2269"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/pull/2272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/svg/svgo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements"
}

CVE-2026-84369 (GCVE-0-2026-84369)

Vulnerability from cvelistv5 – Published: 2026-09-01 20:43 – Updated: 2026-09-02 15:46

Title

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

Summary

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 15:46 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7885 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/svg/svgo/security/advisories/G…	x_refsource_CONFIRM
https://github.com/svg/svgo/pull/2264	x_refsource_MISC
https://github.com/svg/svgo/pull/2269	x_refsource_MISC
https://github.com/svg/svgo/pull/2272	x_refsource_MISC
https://github.com/svg/svgo/commit/0557385564a5c6…	x_refsource_MISC
https://github.com/svg/svgo/commit/994a9f00d79dde…	x_refsource_MISC
https://github.com/svg/svgo/commit/fd51e474a30041…	x_refsource_MISC
https://github.com/svg/svgo/releases/tag/v2.8.4	x_refsource_MISC
https://github.com/svg/svgo/releases/tag/v3.3.5	x_refsource_MISC
https://github.com/svg/svgo/releases/tag/v4.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
svg	svgo	Affected: >= 1.0.0, < 2.8.4 Affected: >= 3.0.0, < 3.3.5 Affected: >= 4.0.0, < 4.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T15:46:08.313290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T15:46:16.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "svgo",
          "vendor": "svg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.8.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:43:52.013Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2264",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2264"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2269",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2269"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2272",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2272"
        },
        {
          "name": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
        },
        {
          "name": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
        },
        {
          "name": "https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v2.8.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v3.3.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v4.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4vpr-x523-8j87",
        "discovery": "UNKNOWN"
      },
      "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84369",
    "datePublished": "2026-09-01T20:43:52.013Z",
    "dateReserved": "2026-09-01T16:27:58.129Z",
    "dateUpdated": "2026-09-02T15:46:16.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-4VPR-X523-8J87

Summary

Details

Impact

Patches

Workarounds

CVE-2026-84369 (GCVE-0-2026-84369)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour