Is CVE-2026-73650 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73650 being exploited in the wild.

How severe is CVE-2026-73650?

Low severity, with a CVSS score of 3.1, published 21 July 2026.

Which products and versions are affected?

Svgo SEMVER:introduced=1.0.0,fixed=2.8.3.

Is there a fix for CVE-2026-73650?

Yes. Svgo: upgrade to 2.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73650 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73650?

Check whether you run Svgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73650: SVGO removeScripts plugin incomplete XSS sanitization bypass

CVE-2026-73650 · Severity: low · CVSS 3.1 · Published 2026-07-21

SVGO is a popular Node.js tool for optimizing SVG graphics. Its removeScripts plugin is designed to strip executable code from SVG files, but it failed to catch namespaced script tags and case-variant JavaScript URIs, leaving XSS attacks possible when used to sanitize untrusted user uploads. Applications relying on this plugin for security could serve malicious SVGs that steal cookies or session tokens from users viewing them on the same domain.

Technologies: Svgo.

Quick answers

Is CVE-2026-73650 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73650 being exploited in the wild.
How severe is CVE-2026-73650?: Low severity, with a CVSS score of 3.1, published 21 July 2026.
Which products and versions are affected?: Svgo SEMVER:introduced=1.0.0,fixed=2.8.3.
Is there a fix for CVE-2026-73650?: Yes. Svgo: upgrade to 2.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73650 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73650?: Check whether you run Svgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Svgo: upgrade to 2.8.3 or later

Technical details

The vulnerability is an incomplete input validation flaw (CWE-184) in SVGO's removeScripts plugin affecting versions 1.0.0–4.0.1. The plugin attempts to remove <script> elements and JavaScript URIs from SVG content but failed in two ways: (1) it did not match namespaced script tags like <svg:script> or <xhtml:script>, and (2) it performed case-sensitive matching on JavaScript URIs instead of case-insensitive matching, allowing variants like "JAVASCRIPT:" to bypass filtering. Attack requires user-supplied SVG input processed through removeScripts then served to another user on the same domain; no authentication is required. Successful exploitation leads to arbitrary JavaScript execution in the victim's browser context, enabling session hijacking and data theft. Patches are available: v2.8.3, v3.3.4, and v4.0.2. Version 1.x is deprecated and will not be patched.

Affected products

svg svgo 1.0.0–1.3.2, 2.0.0–2.8.2, 3.0.0–3.3.3, 4.0.0–4.0.1

Identifiers

CVE-2026-73650
GHSA-2p49-hgcm-8545

Timeline

2026-07-21: disclosed: GHSA-2p49-hgcm-8545 published
2026-07-11: patched: v2.8.3, v3.3.4, v4.0.2 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.