CVE-2026-84370: SVGO removeScripts XSS bypass via namespace and control character

CVE-2026-84370 · Severity: high · CVSS 8.2 · Published 2026-09-01

SVGO is a popular SVG optimization library used by web applications to clean up and reduce the size of SVG image files. The removeScripts plugin, designed to strip potentially dangerous executable links from untrusted SVG files before they are served to users, contained two security flaws that allowed attackers to bypass the filtering. An application using this plugin as its only defense against malicious SVGs could serve attackers' crafted SVG files to users, leading to cross-site scripting attacks that steal cookies, session data, or perform unauthorized actions in the user's browser.

Technologies: Svgo.

Quick answers

Is CVE-2026-84370 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84370 being exploited in the wild.
How severe is CVE-2026-84370?
High severity, with a CVSS score of 8.2, published 1 September 2026.
Which products and versions are affected?
Svgo SEMVER:introduced=1.0.0,fixed=2.8.4.
Is there a fix for CVE-2026-84370?
Yes. Svgo: upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84370 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84370?
Check whether you run Svgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Svgo: upgrade to 2.8.4 or later

Technical details

The removeScripts plugin in SVGO (versions 1.0.0–2.8.3, 3.0.0–3.3.4, 4.0.0–4.0.4) contained incomplete input validation (CWE-184) leading to cross-site scripting (CWE-79). Two distinct bypasses were identified: (1) The plugin checked only unprefixed SVG `<a>` elements but missed namespace-prefixed anchors like `<svg:a href="javascript:alert()">` when the prefix was bound to the SVG namespace. (2) The URL scheme check did not strip ASCII tab (0x09), line-feed (0x0A), or carriage-return (0x0D) characters before testing for `javascript:`, allowing payloads like `java&#9;script:alert()` to remain executable since browsers normalize these characters. An attacker who could upload or inject SVG files would craft a malicious SVG with one of these bypasses; when an application processed it with removeScripts and served the result to users in an active browser context, clicking the link would execute JavaScript in the SVG's origin (potentially accessing cookies, localStorage, modifying content, or performing user actions). The fix, applied in versions 2.8.4, 3.3.5, and 4.1.0, implements namespace-aware anchor detection and strips control characters before scheme validation.

Affected products

  • svg SVGO 1.0.0 to 2.8.3, 3.0.0 to 3.3.4, 4.0.0 to 4.0.4

Identifiers

  • CVE-2026-84370
  • GHSA-w27v-7q3p-w38r

Timeline

  • 2026-08-24: disclosed
  • 2026-09-08: advisory
  • 2026-09-08: patched: Patches released: v2.8.4, v3.3.5, v4.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.