svgo up to 2.8.0/3.3.2/4.0.0 SVG File Parser xml entity expansion

Summaryinfo

A vulnerability, which was classified as problematic, has been found in svgo up to 2.8.0/3.3.2/4.0.0. Affected by this issue is some unknown functionality of the component SVG File Parser. The manipulation leads to xml entity expansion. This vulnerability is uniquely identified as CVE-2026-29074. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in svgo up to 2.8.0/3.3.2/4.0.0. This issue affects an unknown functionality of the component SVG File Parser. The manipulation with an unknown input leads to a xml entity expansion vulnerability. Using CWE to declare the problem leads to CWE-776. The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. Impacted is availability. The summary by CVE is:

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-29074 since 03/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 302193 (Linux Distros Unpatched Vulnerability : CVE-2026-29074), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.8.1 or 3.3.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (302193) and CERT Bund (WID-SEC-2026-0935). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Red Hat Ansible Automation Platform
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• HCL BigFix
• IBM DB2
• IBM App Connect Enterprise
• Red Hat OpenShift

Productinfo

Name

• svgo

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8.0
• 3.3.0
• 3.3.1
• 3.3.2
• 4.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion