CVE-2026-73650 in SVGO
Summary
by MITRE • 08/13/2026
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The SVGO library represents a critical security vulnerability through its removeScripts plugin implementation across multiple version ranges, constituting a server-side request forgery and cross-site scripting risk. This vulnerability stems from insufficient sanitization of script elements within SVG files, where the plugin fails to properly identify and eliminate executable content that may be embedded using namespace prefixes such as svg:script or other alternative XML namespace declarations. The flaw exists in versions 1.0.0 through 2.8.3, 3.0.0 through 3.3.4, and 4.0.0 through 4.0.2, creating a persistent security gap that allows attackers to embed malicious JavaScript code within SVG files that would otherwise be considered safe after optimization. The vulnerability's impact is particularly severe because it operates at the SVG parsing level where content is processed for optimization purposes, meaning that any untrusted SVG input passed through this plugin could result in code execution when users view the optimized SVG file in web browsers or applications that render SVG graphics.
The technical implementation of this vulnerability aligns with CWE-74 and CWE-79 categories, specifically addressing improper neutralization of special elements used in a different context and cross-site scripting flaws. The root cause lies in the plugin's inadequate regex pattern matching and namespace handling, where JavaScript URIs are matched case sensitively rather than using case-insensitive matching that would prevent exploitation through variations such as javascript: vs JavaScript:. This implementation flaw creates a path for attackers to bypass the intended security controls by utilizing different case variations of script protocols or by employing namespaced elements that the original plugin logic does not account for, effectively allowing persistent script execution within SVG documents. The vulnerability's manifestation occurs during the optimization process when the removeScriptElement plugin processes SVG content and incorrectly preserves potentially malicious code elements.
The operational impact of this vulnerability extends beyond simple code execution to encompass full data exfiltration capabilities through local storage and cookie access, making it particularly dangerous in environments where users may encounter untrusted SVG content. When applications process SVG files using vulnerable versions of SVGO with the removeScripts plugin enabled, they create a vector for attackers to embed malicious scripts that execute automatically when users open or view the optimized SVG files. This creates a persistent risk across multiple attack surfaces including web applications, content management systems, and any platform that accepts and processes SVG uploads. The vulnerability can be exploited in scenarios such as user profile avatars, image galleries, or document processing systems where SVG files are rendered without proper security validation, potentially leading to session hijacking, data theft, or further compromise of user systems through advanced persistent threats.
Mitigation strategies for this vulnerability require immediate version upgrades to patched releases including 2.8.3, 3.3.4, and 4.0.2, which address the namespace handling and case-sensitive matching issues within the removeScripts plugin. Organizations should implement comprehensive SVG validation procedures that go beyond SVGO's built-in sanitization, including additional content security policy enforcement and strict file type verification before processing. The remediation process must also include thorough code review of any custom implementations that utilize SVGO, ensuring that proper input validation and output encoding are implemented at multiple layers of the application stack. Security teams should conduct vulnerability assessments specifically targeting SVG processing pipelines and implement monitoring for suspicious script content within SVG files, particularly focusing on namespace declarations and URI schemes that may bypass traditional filtering mechanisms. Additionally, organizations should consider implementing Web Application Firewalls or specialized SVG sanitization libraries as additional defensive measures to prevent exploitation of similar vulnerabilities in other SVG processing components.