Executive brief
SVGO, a popular tool for optimizing SVG files, contains a flaw in its script-removal plugin. If a website uses this plugin to clean user-uploaded images, an attacker could bypass the filter to include malicious scripts. If another user views the processed image, the script could run in their browser, potentially stealing their login cookies or personal data.
Technical details
SVGO's script removal plugins (removeScripts in v4, removeScriptElement in v1-v3) fail to account for two specific bypass techniques: namespaced/prefixed script elements (e.g., <svg:script>) and case-sensitive matching of JavaScript URIs (e.g., 'JavaScript:' instead of 'javascript:'). An attacker can provide a specially crafted SVG that bypasses these filters. If the resulting SVG is served to users, it can execute arbitrary JavaScript in the context of the hosting domain (XSS). The vulnerability is present in the optional script removal plugins which are disabled by default. Patches are available in versions 2.8.3, 3.3.4, and 4.0.2.
Affected products
- svg svgo >= 1.0.0, < 2.8.3
- svg svgo >= 3.0.0, < 3.3.4
- svg svgo >= 4.0.0, < 4.0.2
Timeline
- 2026-07-11: disclosed
- 2026-07-21: advisory