The SVGO removeScripts plugin is intended to remove script elements, JavaScript URIs, and event handlers from SVG files to reduce XSS risk. However, it did not handle namespaced or prefixed <script> elements, such as <svg:script>, leaving them intact. Additionally, it matched JavaScript URIs case-sensitively, missing variants with different casing. These shortcomings mean that some executable scripts could remain in SVGs after optimization, posing an XSS risk if untrusted SVGs are processed and served. The issue affects SVGO versions >=1.0.0 <2.8.3, >=3.0.0 <3.3.4, and >=4.0.0 <4.0.2. Patches are available in versions 2.8.3, 3.3.4, and 4.0.2, which improve namespace-aware handling and case-insensitive URI matching. Users are advised to upgrade or use dedicated SVG sanitization tools before SVGO processing.

If SVGO's removeScripts plugin is used on untrusted SVG input, some executable scripts may remain due to incomplete script removal. This can lead to cross-site scripting (XSS) vulnerabilities if the SVG is served to other users on the same domain, potentially allowing script execution that can access cookies or local storage. The vulnerability affects multiple SVGO versions before the patches. Users who only use SVGO locally on trusted SVGs or in build pipelines are unlikely to be impacted.

Fixes for this vulnerability are available in SVGO versions 2.8.3, 3.3.4, and 4.0.2. Users should upgrade to at least these versions to ensure complete removal of executable scripts by the removeScripts plugin. If upgrading is not possible, users should consider using dedicated SVG sanitization tools prior to SVGO processing. The removeScripts plugin is disabled by default, so users relying on it for sanitization should verify their configurations. No additional action is required if the plugin is not enabled or if SVGs are trusted.