CVE-2026-84370: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in svg svgo

The vulnerability in SVGO's removeScripts plugin (also known as removeScriptElement in versions 2 and 3) arises because it fails to recognize namespace-prefixed SVG anchor elements (e.g., svg:a) with href or namespaced *:href attributes. Additionally, it does not remove ASCII tab, line-feed, or carriage-return characters before validating URL schemes. Since browsers strip these characters before parsing, malicious executable links can bypass the plugin's filtering. When an application processes attacker-controlled SVG files using affected SVGO versions and serves the output in an active browser context, a victim activating the malicious link can have scripts executed in the SVG's origin, potentially exposing data or modifying content. This vulnerability is addressed in SVGO versions 2.8.4, 3.3.5, and 4.1.0.

Successful exploitation allows an attacker to execute scripts in the origin of the SVG, leading to potential data exposure, content modification, or actions performed with the victim's privileges. The vulnerability requires user interaction (UI:R) and network attack vector (AV:N). It has a high confidentiality impact, limited integrity impact, and no availability impact. The CVSS score is 8.2 (high severity).

A fix is available in SVGO versions 2.8.4, 3.3.5, and 4.1.0. Users should upgrade to one of these versions or later to remediate the vulnerability. No vendor advisory content contradicts this; therefore, upgrading is the recommended mitigation.