Description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-01T21:18:48.037Z",
  "pubdate": "2026-09-01T21:18:48.037Z",
  "executiveSummary": "SVGO (SVG Optimizer) contains a vulnerability in its 'removeScripts' plugin (known as 'removeScriptElement' in versions 2 and 3) that permits the persistence of executable content within SVG files. The vulnerability allows attackers to bypass intended security controls by leveraging 'foreignObject' elements and specific event-handler attributes, which the plugin fails to inspect or sanitize.\nThis flaw enables Cross-Site Scripting (XSS) when optimized SVGs are served directly in an active browser context. An attacker can craft malicious SVG payloads containing scripts or event handlers that execute in the context of the victim's session. The impact is significant, potentially allowing unauthorized data exposure, session hijacking, content manipulation, or the execution of malicious actions on behalf of the victim.\nThe vulnerability affects versions 1.0.0 through 2.8.3, 3.0.0 through 3.3.4, and 4.0.0 through 4.0.x. Organizations relying solely on SVGO for sanitizing user-uploaded SVG files are at high risk. Exploitation does not require authentication and is triggered when the application renders the malicious SVG in a browser. Remediation requires upgrading to the patched versions 2.8.4, 3.3.5, or 4.1.0.",
  "technicalDetails": "The vulnerability resides in the 'removeScripts' plugin (implemented in 'plugins/removeScripts.js'), which is responsible for stripping executable scripts from SVG files. The root cause of this flaw is the plugin's insufficient scope regarding the SVG specification. While the plugin successfully removes standard 'script' elements, it fails to perform recursive or comprehensive inspection of nested XML structures, specifically those contained within 'foreignObject' elements.\nSVG 'foreignObject' elements allow the embedding of non-SVG content, such as XHTML. The SVGO parser does not adequately sanitize the interior of these elements, allowing attackers to hide malicious payloads. Furthermore, the plugin fails to neutralize event-handler attributes (e.g., 'onload', 'onbeforetoggle') and URI-based execution vectors within attributes such as 'action', 'data', 'formaction', 'href', and 'src'. The 'srcdoc' attribute, which can contain nested HTML documents, is also left untouched, providing an additional vector for script execution.\nThe attack flow begins when an attacker submits a malicious SVG file to an application that processes the input through the vulnerable SVGO plugin. Because the plugin does not identify or remove the hidden payloads within the 'foreignObject' or the various event-handler attributes, the 'optimized' SVG remains functionally malicious. When the application serves this 'optimized' file to a victim's browser, the browser parses the SVG and executes the embedded script or triggers the event handler.\nBecause the execution occurs within the origin of the web application serving the SVG, the attacker gains the ability to execute arbitrary JavaScript in the victim's session. This leads to post-exploitation impacts such as the theft of sensitive session cookies (facilitating account takeover), unauthorized modifications to the Document Object Model (DOM), or the silent performance of sensitive application actions. The lack of proper content inspection means that even if an application employs SVGO as its primary security layer, it remains vulnerable to sophisticated XSS attacks. The issue is persistent across versions 1.0.0 up to 2.8.3, 3.3.4, and 4.0.x, necessitating an immediate upgrade to the secure versions 2.8.4, 3.3.5, or 4.1.0 where the sanitization logic has been expanded to correctly handle these nested and attribute-based vectors."
}