Vulnerability in SVGO Node.js Library Allows Executable HTML Injection
CVE-2026-84369
6.1MEDIUM
What is CVE-2026-84369?
The SVGO library has a vulnerability affecting specific versions that could permit the execution of scripts via attacker-controlled SVG files. The opt-in 'removeScripts' plugin fails to adequately sanitize SVG foreignObject elements, leaving attributes like onload, srcdoc, and others potentially exposed. This flaw can lead to unauthorized script execution within the victim's context when the SVG is viewed in a browser. It is crucial for users to update to the fixed versions 2.8.4, 3.3.5, or 4.1.0 to secure their applications.
Affected Version(s)
svgo >= 1.0.0, < 2.8.4 < 1.0.0, 2.8.4
svgo >= 3.0.0, < 3.3.5 < 3.0.0, 3.3.5
svgo >= 4.0.0, < 4.1.0 < 4.0.0, 4.1.0