Go to packages list

svgo

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 3HighAffects 9 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 3 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
4vulnerabilities
  • Critical0 (0.0%)
  • High3 (75.0%)
  • Medium0 (0.0%)
  • Moderate1 (25.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (4)

Known vulnerabilities affecting svgo, based on data from OSV.

Vulnerabilities affecting svgo
IDSeveritySummaryAffected versionsPublishedSource
GHSA-4vpr-x523-8j87ModerateSVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements## Summary SVGO's opt-in `removeScripts` plugin did not inspect executable HTML content inside SVG `<foreignObject>` elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS). SVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths. ## Details Although the plugin removed SVG and XHTML `<script>` elements, it left other HTML execution paths in
  • >= 1.0.0, < 2.8.4
  • >= 3.0.0, < 3.3.5
  • >= 4.0.0, < 4.1.0
GitHub (opens in a new tab)
GHSA-w27v-7q3p-w38rHighSVGO: removeScripts allows executable links through namespace and control-character bypasses## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS). SVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths. ## Details Two related bypasses were present: 1. The plugin inspected unprefixed SV
  • >= 1.0.0, < 2.8.4
  • >= 3.0.0, < 3.3.5
  • >= 4.0.0, < 4.1.0
GitHub (opens in a new tab)
GHSA-2p49-hgcm-8545HighSVGO removeScripts plugin leaves some executable scripts intact### Summary SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. ### Details SVGO has a plugin for removing scripts from an SVG, which removes: - `<script>` elements - JavaScript URIs (v4 and v3 only) - `on…` event handlers (v4 and v3 only) While SVGO is not a sanitization library, SVGO continues to maintain the plugin for those already using it for this purpose. However, there were two
  • >= 1.0.0, < 2.8.3
  • >= 3.0.0, < 3.3.4
  • >= 4.0.0, < 4.0.2
GitHub (opens in a new tab)
GHSA-xpqw-6gx7-v673HighSVGO DoS through entity expansion in DOCTYPE (Billion Laughs)### Summary SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with `JavaScript heap out of memory`. ### Details The upstream XML parser ([sax](https://www.npmjs.com/package/sax)) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the `DOCTYPE`, inserting them into `parser.ENTITIES`, and enabled `unparsedEntities`. This gives us the desired behavior of supporting SVGs with entities declared in the
  • >= 2.1.0, < 2.8.1
  • >= 3.0.0, < 3.3.3
  • >= 4.0.0, < 4.0.1
GitHub (opens in a new tab)
  • GHSA-4vpr-x523-8j87Moderate
    SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
    • >= 1.0.0, < 2.8.4
    • >= 3.0.0, < 3.3.5
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 1.0.0, < 2.8.4
    • >= 3.0.0, < 3.3.5
    • >= 4.0.0, < 4.1.0

    ## Summary SVGO's opt-in `removeScripts` plugin did not inspect executable HTML content inside SVG `<foreignObject>` elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS). SVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths. ## Details Although the plugin removed SVG and XHTML `<script>` elements, it left other HTML execution paths in

    CVE: CVE-2026-84369

  • GHSA-w27v-7q3p-w38rHigh
    SVGO: removeScripts allows executable links through namespace and control-character bypasses
    • >= 1.0.0, < 2.8.4
    • >= 3.0.0, < 3.3.5
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 1.0.0, < 2.8.4
    • >= 3.0.0, < 3.3.5
    • >= 4.0.0, < 4.1.0

    ## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS). SVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths. ## Details Two related bypasses were present: 1. The plugin inspected unprefixed SV

    CVE: CVE-2026-84370

  • GHSA-2p49-hgcm-8545High
    SVGO removeScripts plugin leaves some executable scripts intact
    • >= 1.0.0, < 2.8.3
    • >= 3.0.0, < 3.3.4
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 1.0.0, < 2.8.3
    • >= 3.0.0, < 3.3.4
    • >= 4.0.0, < 4.0.2

    ### Summary SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. ### Details SVGO has a plugin for removing scripts from an SVG, which removes: - `<script>` elements - JavaScript URIs (v4 and v3 only) - `on…` event handlers (v4 and v3 only) While SVGO is not a sanitization library, SVGO continues to maintain the plugin for those already using it for this purpose. However, there were two

    CVE: CVE-2026-73650

  • GHSA-xpqw-6gx7-v673High
    SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
    • >= 2.1.0, < 2.8.1
    • >= 3.0.0, < 3.3.3
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 2.1.0, < 2.8.1
    • >= 3.0.0, < 3.3.3
    • >= 4.0.0, < 4.0.1

    ### Summary SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with `JavaScript heap out of memory`. ### Details The upstream XML parser ([sax](https://www.npmjs.com/package/sax)) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the `DOCTYPE`, inserting them into `parser.ENTITIES`, and enabled `unparsedEntities`. This gives us the desired behavior of supporting SVGs with entities declared in the

    CVE: CVE-2026-29074

Showing 1-4 of 4 vulnerabilities