Skip to content
Threat Feed
Subscribe

Product

SVGO (< 4.0.2)

1 brief RSS
high advisory

SVGO removeScripts Plugin Bypass Leads to Cross-Site Scripting

A vulnerability in the SVGO library's `removeScripts` plugin, affecting versions prior to 2.8.3, 3.3.4, and 4.0.2, allowed namespaced script elements and case-insensitive JavaScript URIs to bypass sanitization, potentially leading to Cross-Site Scripting (XSS) in web applications serving untrusted SVGs.

SVGO +2 xss svg sanitization-bypass web-vulnerability
2t