CVE-2026-84369 (GCVE-0-2026-84369)
Vulnerability from cvelistv5
Published
2026-09-01 20:43
Modified
2026-09-02 15:46
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
References
Impacted products
Vendor Product Version
svg svgo Version: >= 1.0.0, < 2.8.4
Version: >= 3.0.0, < 3.3.5
Version: >= 4.0.0, < 4.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T15:46:08.313290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T15:46:16.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "svgo",
          "vendor": "svg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.8.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:43:52.013Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2264",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2264"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2269",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2269"
        },
        {
          "name": "https://github.com/svg/svgo/pull/2272",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/pull/2272"
        },
        {
          "name": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c"
        },
        {
          "name": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f"
        },
        {
          "name": "https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v2.8.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v2.8.4"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v3.3.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v3.3.5"
        },
        {
          "name": "https://github.com/svg/svgo/releases/tag/v4.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/svg/svgo/releases/tag/v4.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4vpr-x523-8j87",
        "discovery": "UNKNOWN"
      },
      "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84369",
    "datePublished": "2026-09-01T20:43:52.013Z",
    "dateReserved": "2026-09-01T16:27:58.129Z",
    "dateUpdated": "2026-09-02T15:46:16.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-84369\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-02T15:46:08.313290Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-02T15:46:11.972Z\"}}], \"cna\": {\"title\": \"SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements\", \"source\": {\"advisory\": \"GHSA-4vpr-x523-8j87\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"svg\", \"product\": \"svgo\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.0.0, \u003c 2.8.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.0.0, \u003c 3.3.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.1.0\"}]}], \"references\": [{\"url\": \"https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87\", \"name\": \"https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/svg/svgo/pull/2264\", \"name\": \"https://github.com/svg/svgo/pull/2264\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/pull/2269\", \"name\": \"https://github.com/svg/svgo/pull/2269\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/pull/2272\", \"name\": \"https://github.com/svg/svgo/pull/2272\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c\", \"name\": \"https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f\", \"name\": \"https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327\", \"name\": \"https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/releases/tag/v2.8.4\", \"name\": \"https://github.com/svg/svgo/releases/tag/v2.8.4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/releases/tag/v3.3.5\", \"name\": \"https://github.com/svg/svgo/releases/tag/v3.3.5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/svg/svgo/releases/tag/v4.1.0\", \"name\": \"https://github.com/svg/svgo/releases/tag/v4.1.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer\u0027s origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-01T20:43:52.013Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-84369\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-02T15:46:16.971Z\", \"dateReserved\": \"2026-09-01T16:27:58.129Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-01T20:43:52.013Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.