The svgo Node.js library, used for optimizing SVG files, contains a cross-site scripting vulnerability in its removeScripts plugin (removeScriptElement in versions 1 through 3). This plugin does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively, leaving executable content in optimized SVGs. Applications that process untrusted SVG input with this plugin enabled and serve the output may allow script execution when another user opens the SVG, exposing local storage or cookies. The vulnerability affects versions from 1.0.0 up to but not including 2.8.3, 3.3.4, and 4.0.2, where the issue is fixed.

Exploitation of this vulnerability can lead to cross-site scripting attacks, allowing an attacker to execute scripts in the context of users viewing the optimized SVG files. This can result in exposure of sensitive information such as local storage data or cookies. The CVSS score of 8.2 indicates a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.

A fix is available in svgo versions 2.8.3, 3.3.4, and 4.0.2. Users and developers should upgrade to one of these versions or later to remediate this vulnerability. Patch status is confirmed by the version information specifying the fixed versions. No additional mitigation steps are indicated in the advisory.