Junglewise Threat Intelligence

CVE-2026-84370: SVGO removeScripts XSS bypass via namespace and control character

CVE-2026-84370 · Severity: high · CVSS 8.2 · Published 2026-09-08

Executive brief

SVGO is a popular SVG optimization library used by web applications to clean up and reduce the size of SVG image files. The removeScripts plugin, designed to strip potentially dangerous executable links from untrusted SVG files before they are served to users, contained two security flaws that allowed attackers to bypass the filtering. An application using this plugin as its only defense against malicious SVGs could serve attackers' crafted SVG files to users, leading to cross-site scripting attacks that steal cookies, session data, or perform unauthorized actions in the user's browser.

Technical details

The removeScripts plugin in SVGO (versions 1.0.0–2.8.3, 3.0.0–3.3.4, 4.0.0–4.0.4) contained incomplete input validation (CWE-184) leading to cross-site scripting (CWE-79). Two distinct bypasses were identified: (1) The plugin checked only unprefixed SVG `<a>` elements but missed namespace-prefixed anchors like `<svg:a href="javascript:alert()">` when the prefix was bound to the SVG namespace. (2) The URL scheme check did not strip ASCII tab (0x09), line-feed (0x0A), or carriage-return (0x0D) characters before testing for `javascript:`, allowing payloads like `java&#9;script:alert()` to remain executable since browsers normalize these characters. An attacker who could upload or inject SVG files would craft a malicious SVG with one of these bypasses; when an application processed it with removeScripts and served the result to users in an active browser context, clicking the link would execute JavaScript in the SVG's origin (potentially accessing cookies, localStorage, modifying content, or performing user actions). The fix, applied in versions 2.8.4, 3.3.5, and 4.1.0, implements namespace-aware anchor detection and strips control characters before scheme validation.

Affected products

  • svg SVGO 1.0.0 to 2.8.3, 3.0.0 to 3.3.4, 4.0.0 to 4.0.4

Timeline

  • 2026-08-24: disclosed
  • 2026-09-08: advisory
  • 2026-09-08: patched: Patches released: v2.8.4, v3.3.5, v4.1.0

References