Skip to content
Threat Feed
Subscribe

Vendor

SVGO

2 briefs RSS
high advisory

SVGO removeScripts Plugin XSS Bypass

The SVGO 'removeScripts' plugin is vulnerable to XSS bypasses due to insufficient validation of namespace-prefixed SVG anchors and control-character obfuscation in URL schemes, potentially allowing script execution when untrusted SVG content is rendered.

svgo +2 xss svg sanitization-bypass cve-2026-84370
1t 1c
high advisory

SVGO removeScripts Plugin Bypass Leads to Cross-Site Scripting

A vulnerability in the SVGO library's `removeScripts` plugin, affecting versions prior to 2.8.3, 3.3.4, and 4.0.2, allowed namespaced script elements and case-insensitive JavaScript URIs to bypass sanitization, potentially leading to Cross-Site Scripting (XSS) in web applications serving untrusted SVGs.

SVGO +2 xss svg sanitization-bypass web-vulnerability
2t