CVE-2026-84370
Description
A flaw was found in SVGO (SVG Optimizer), a Node.js library for optimizing SVG files. The removeScripts plugin, intended to filter executable links, incompletely processes namespace-prefixed SVG anchor elements and fails to remove ASCII control characters before validating URL schemes. A remote attacker could craft a malicious SVG file that, when processed by an application and served in a browser, allows for arbitrary script execution in the SVG's origin if a victim activates the embedded link. This could lead to information disclosure, content modification, or unauthorized actions performed as the victim.
Statement
A flaw was found in SVGO's removeScripts plugin (opt-in), which is designed to filter executable links from SVG files. The plugin incompletely handles namespace-prefixed SVG anchor elements (e.g., svg:a) and fails to remove ASCII control characters (tab, line-feed, carriage-return) before validating URL schemes. When an application enables this plugin to process untrusted SVG input and serves the result in a browser context, an attacker can craft a malicious SVG that bypasses the filter. If a victim activates the embedded link, arbitrary script can execute in the SVG's origin, potentially leading to information disclosure, content modification, or unauthorized actions.
Red Hat Product Security has determined that the impact of this flaw is Important. Most Red Hat products that bundle SVGO do not use it for SVG processing or do not enable the removeScripts plugin. The affected products have been identified and are receiving updates.
Mitigation
Do not use SVGO's removeScripts plugin as the sole protection mechanism for untrusted SVG input. If processing untrusted SVG files, use a comprehensive SVG sanitization library designed for security purposes, or avoid serving processed SVGs in active browser contexts. For applications currently using the removeScripts plugin, upgrade SVGO to version 2.8.4, 3.3.5, or 4.1.0 (or later) as appropriate for your version series.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.2 | N/A | 8.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
