{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/svgo--2.8.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SVGO (\u003c 2.8.3)","SVGO (\u003c 3.3.4)","SVGO (\u003c 4.0.2)"],"_cs_severities":["high"],"_cs_tags":["xss","svg","sanitization-bypass","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["SVGO"],"content_html":"\u003cp\u003eA significant vulnerability has been identified in the \u003ccode\u003eremoveScripts\u003c/code\u003e plugin of the SVGO library, a Node.js-based tool for optimizing SVG files. This plugin, although disabled by default, was intended to sanitize SVG files by removing executable JavaScript. However, it failed to adequately detect and remove certain types of malicious scripts, specifically those using namespaced \u003ccode\u003e\u0026lt;svg:script\u0026gt;\u003c/code\u003e elements or case-insensitive \u003ccode\u003eJavaScript:\u003c/code\u003e URIs. This oversight means that web applications relying on SVGO with this plugin enabled for sanitization of untrusted user-supplied SVG content could inadvertently host and serve malicious SVGs. If a victim user then accesses these unsanitized SVGs through the same domain, attackers could execute arbitrary JavaScript within their browser, leading to Cross-Site Scripting (XSS) attacks. Such attacks could compromise user sessions by stealing cookies or other sensitive local storage data.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious SVG file containing an embedded script using either a namespaced \u003ccode\u003e\u0026lt;svg:script\u0026gt;\u003c/code\u003e element (e.g., \u003ccode\u003e\u0026lt;svg:script\u0026gt;alert(document.cookie);\u0026lt;/svg:script\u0026gt;\u003c/code\u003e) or a case-insensitively encoded JavaScript URI (e.g., \u003ccode\u003e\u0026lt;a uwu:href=\u0026quot;JavaScript:(() =\u0026gt; { alert(document.cookie) })();\u0026quot;\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker uploads this malicious SVG to a web application that accepts user-supplied SVG content and utilizes the SVGO library with the \u003ccode\u003eremoveScripts\u003c/code\u003e plugin enabled for sanitization.\u003c/li\u003e\n\u003cli\u003eThe web application processes the uploaded SVG using SVGO. Due to the vulnerability, the \u003ccode\u003eremoveScripts\u003c/code\u003e plugin fails to identify and remove the maliciously crafted script elements.\u003c/li\u003e\n\u003cli\u003eThe unsanitized, malicious SVG is stored by the web application.\u003c/li\u003e\n\u003cli\u003eA victim user accesses a web page on the same domain that dynamically loads or displays the previously uploaded malicious SVG.\u003c/li\u003e\n\u003cli\u003eThe victim's web browser renders the SVG content. Since the malicious script was not removed, the embedded JavaScript is executed within the context of the victim's browser session.\u003c/li\u003e\n\u003cli\u003eThe executed JavaScript (e.g., \u003ccode\u003ealert(document.cookie)\u003c/code\u003e) can then perform actions such as stealing session cookies, local storage data, or defacing the web page, leading to Cross-Site Scripting (XSS).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eIf organizations run SVGO on untrusted input, such as user uploads to a web application, and depend on the \u003ccode\u003eremoveScripts\u003c/code\u003e plugin for sanitization, this vulnerability directly impacts their users. Unsanitized SVGs could be served to other users, leading to Cross-Site Scripting (XSS). This allows attackers to execute arbitrary client-side script code in the victim's browser. The potential consequences include session hijacking through stolen \u003ccode\u003edocument.cookie\u003c/code\u003e or \u003ccode\u003elocalStorage\u003c/code\u003e data, defacement of the affected web page, redirection to malicious sites, or other client-side attacks. The vulnerability affects SVGO versions prior to 2.8.3, 3.3.4, and 4.0.2. It is less likely to impact users who only use SVGO locally or in build pipelines where untrusted input is not processed for public consumption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SVGO dependencies immediately for versions 3.0.0 through 4.0.1 to \u0026gt;=4.0.2 or \u0026gt;=3.3.4 to mitigate the vulnerability.\u003c/li\u003e\n\u003cli\u003eUpgrade SVGO dependencies immediately for versions 2.0.0 through 2.8.2 to \u0026gt;=2.8.3 to mitigate the vulnerability in the \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e elements. Note that v2 does not remove JavaScript URIs or event handlers.\u003c/li\u003e\n\u003cli\u003eFor users on SVGO v1.x.x, upgrade to a more recent version as v1 is deprecated and will not receive patches.\u003c/li\u003e\n\u003cli\u003eIf SVG sanitization is a critical requirement, consider using a dedicated SVG sanitization library as a workaround before passing SVGs to SVGO for optimization.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:43:22Z","date_published":"2026-07-21T19:43:22Z","id":"https://feed.craftedsignal.io/briefs/2026-07-svgo-removescripts-bypass/","summary":"A vulnerability in the SVGO library's `removeScripts` plugin, affecting versions prior to 2.8.3, 3.3.4, and 4.0.2, allowed namespaced script elements and case-insensitive JavaScript URIs to bypass sanitization, potentially leading to Cross-Site Scripting (XSS) in web applications serving untrusted SVGs.","title":"SVGO removeScripts Plugin Bypass Leads to Cross-Site Scripting","url":"https://feed.craftedsignal.io/briefs/2026-07-svgo-removescripts-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - SVGO (\u003c 2.8.3)","version":"https://jsonfeed.org/version/1.1"}