SVG Optimizer Library Vulnerabilities in Node.js by SVGO
CVE-2026-84370
8.2HIGH
What is CVE-2026-84370?
The SVG Optimizer library (SVGO) contains vulnerabilities in its removeScripts plugin, which improperly filters executable links in user-provided SVG inputs. This security flaw can allow attackers to embed malicious scripts in SVG files, which, when processed by a victim’s browser, can execute unauthorized scripts, potentially leading to data exposure, content modification, or other harmful actions. Affected versions prior to 2.8.4, 3.3.5, and 4.1.0 should be updated to protect against these exploits.
Affected Version(s)
svgo >= 1.0.0, < 2.8.4 < 1.0.0, 2.8.4
svgo >= 3.0.0, < 3.3.5 < 3.0.0, 3.3.5
svgo >= 4.0.0, < 4.1.0 < 4.0.0, 4.1.0