CVE-2026-84369: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in svg svgo

The vulnerability (CVE-2026-84369) affects the SVGO library's removeScripts plugin, which is designed to remove script elements from SVG files. However, it does not inspect executable HTML content within SVG foreignObject elements, allowing event-handler attributes (e.g., onload, onbeforetoggle), srcdoc documents, and executable URLs in attributes like action, data, formaction, href, and src to remain. When an application relies solely on this plugin for protection and serves the optimized SVG in an active browser context, an attacker can inject scripts that execute in the victim's origin, potentially exposing data or modifying content. The vulnerability is addressed in SVGO versions 2.8.4, 3.3.5, and 4.1.0.

Exploitation of this vulnerability can lead to cross-site scripting (XSS) attacks, allowing an attacker to execute arbitrary scripts in the context of the victim's browser origin. This can result in data exposure, content manipulation, or unauthorized actions performed on behalf of the victim. The CVSS score of 6.1 indicates a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impact on confidentiality and integrity but not availability.

A fix is available in SVGO versions 2.8.4, 3.3.5, and 4.1.0. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading immediately is not possible, do not rely solely on the removeScripts plugin for SVG sanitization, and consider additional input validation or sanitization measures before serving SVG content in active browser contexts.