Cpe:2.3:a:svgo_project:svgo:*:*:*:*:*:node.js:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asvgo_projectsvgonode.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 21:50:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSVGO removeScripts Plugin XSS Bypasshttps://feed.craftedsignal.io/briefs/2026-09-svgo-xss-bypass/Tue, 08 Sep 2026 21:50:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-svgo-xss-bypass/The SVGO 'removeScripts' plugin is vulnerable to XSS bypasses due to insufficient validation of namespace-prefixed SVG anchors and control-character obfuscation in URL schemes, potentially allowing script execution when untrusted SVG content is rendered.SVGO (SVG Optimizer) contains a security flaw in its removeScripts plugin, identified as CVE-2026-84370. The plugin, intended to strip executable script elements and links from SVG files, fails to adequately neutralize malicious payloads due to two specific bypass mechanisms. First, the plugin only validates unprefixed <a> tags and ignores namespace-prefixed anchors (e.g., <svg:a>), allowing executable links to persist. Second, the URL scheme validator does not sanitize embedded ASCII control characters such as tabs, line feeds, or carriage returns. Browsers ignore these characters during URI parsing, effectively allowing attackers to obfuscate javascript: URI schemes (e.g., java&#9;script:) to bypass the plugin's pattern matching.

This vulnerability affects versions of the svgo npm package across major release lines. Users relying on this plugin as the sole sanitization mechanism for untrusted user-provided SVG files are at risk of cross-site scripting (XSS) if the optimized output is rendered in an active browser context.

Impact

Successful exploitation occurs when an application processes untrusted, attacker-controlled SVG files using the vulnerable removeScripts plugin and subsequently renders these files in a victim's browser session. By leveraging these bypasses, an attacker can execute arbitrary JavaScript within the context of the affected application's origin. This can lead to session hijacking via cookie theft, unauthorized actions performed on behalf of the user, or manipulation of the application's DOM. The severity is heightened for applications that serve user-uploaded SVGs in same-origin contexts.

Recommendation

  1. Patch immediately by upgrading to the designated fixed versions: upgrade v2 users to 2.8.4, v3 users to 3.3.5, and v4 users to 4.1.0.
  2. For applications handling hostile or untrusted SVG input, implement a dedicated SVG sanitization library (such as DOMPurify) as a pre-processing step before passing input to SVGO.
  3. Where possible, serve user-controlled SVG files in a sandboxed, cross-origin context (e.g., using a dedicated domain or Content-Security-Policy headers) to minimize the impact of potential XSS.
]]>highadvisoryxsssvgsanitization-bypasscve-2026-84370