GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-84370

Vulnerability from fkie_nvd - Published: 2026-09-01 21:18 - Updated: 2026-09-04 03:17
Severity
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Summary
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
References
security-advisories@github.comhttps://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
security-advisories@github.comhttps://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2
security-advisories@github.comhttps://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
security-advisories@github.comhttps://github.com/svg/svgo/pull/2268
security-advisories@github.comhttps://github.com/svg/svgo/pull/2269
security-advisories@github.comhttps://github.com/svg/svgo/pull/2272
security-advisories@github.comhttps://github.com/svg/svgo/releases/tag/v2.8.4
security-advisories@github.comhttps://github.com/svg/svgo/releases/tag/v3.3.5
security-advisories@github.comhttps://github.com/svg/svgo/releases/tag/v4.1.0
security-advisories@github.comhttps://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "svgo",
          "vendor": "svg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.8.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin\u0027s check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
    }
  ],
  "id": "CVE-2026-84370",
  "lastModified": "2026-09-04T03:17:43.770",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84370",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-04T02:11:59.412708Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T21:18:48.217",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/pull/2268"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/pull/2269"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/pull/2272"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.