SVGO removeScripts Plugin XSS Bypass

SVGO (SVG Optimizer) contains a security flaw in its removeScripts plugin, identified as CVE-2026-84370. The plugin, intended to strip executable script elements and links from SVG files, fails to adequately neutralize malicious payloads due to two specific bypass mechanisms. First, the plugin only validates unprefixed <a> tags and ignores namespace-prefixed anchors (e.g., <svg:a>), allowing executable links to persist. Second, the URL scheme validator does not sanitize embedded ASCII control characters such as tabs, line feeds, or carriage returns. Browsers ignore these characters during URI parsing, effectively allowing attackers to obfuscate javascript: URI schemes (e.g., java	script:) to bypass the plugin's pattern matching.

This vulnerability affects versions of the svgo npm package across major release lines. Users relying on this plugin as the sole sanitization mechanism for untrusted user-provided SVG files are at risk of cross-site scripting (XSS) if the optimized output is rendered in an active browser context.

Impact

Successful exploitation occurs when an application processes untrusted, attacker-controlled SVG files using the vulnerable removeScripts plugin and subsequently renders these files in a victim's browser session. By leveraging these bypasses, an attacker can execute arbitrary JavaScript within the context of the affected application's origin. This can lead to session hijacking via cookie theft, unauthorized actions performed on behalf of the user, or manipulation of the application's DOM. The severity is heightened for applications that serve user-uploaded SVGs in same-origin contexts.

Recommendation

1. Patch immediately by upgrading to the designated fixed versions: upgrade v2 users to 2.8.4, v3 users to 3.3.5, and v4 users to 4.1.0.
2. For applications handling hostile or untrusted SVG input, implement a dedicated SVG sanitization library (such as DOMPurify) as a pre-processing step before passing input to SVGO.
3. Where possible, serve user-controlled SVG files in a sandboxed, cross-origin context (e.g., using a dedicated domain or Content-Security-Policy headers) to minimize the impact of potential XSS.