Description

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-01T21:18:48.217Z",
  "pubdate": "2026-09-01T21:18:48.217Z",
  "executiveSummary": "SVGO, a Node.js library for SVG optimization, contains a security vulnerability in its removeScripts plugin (removeScriptElement in versions 2 and 3).\nThe vulnerability allows for the bypass of XSS protections by failing to properly sanitize namespaced elements and obfuscated URL schemes.\nThe flaw affects versions 1.0.0 through 2.8.3, 3.0.0 through 3.3.4, and 4.0.0. An attacker can exploit this by crafting malicious SVG files containing obscured 'javascript:' URI schemes or namespace-prefixed anchor elements that bypass filter logic.\nWhen an application processes and serves these SVGs in a browser, a user interacting with the link can trigger Cross-Site Scripting (XSS).\nThis impacts the confidentiality and integrity of the application context, allowing attackers to execute arbitrary scripts in the victim's origin, exfiltrate sensitive data, or perform unauthorized actions as the user.\nThe vulnerability requires the target to have the opt-in 'removeScripts' plugin enabled. Immediate updates to version 2.8.4, 3.3.5, or 4.1.0 are required to remediate this risk.",
  "technicalDetails": "The vulnerability resides in the plugins/removeScripts.js and lib/svgo/tools.js files of the SVGO library. The removeScripts plugin is designed to strip executable links and script elements from SVG files to prevent XSS attacks. However, the existing implementation fails to account for namespace-prefixed SVG anchor elements (e.g., svg:a) and namespaced attributes (e.g., *:href).\nA secondary root cause involves the inadequate sanitization of whitespace characters. The plugin does not strip ASCII control characters, such as tabs (0x09), line-feeds (0x0A), or carriage-returns (0x0D), before performing its regex-based URL scheme validation. Because modern web browsers normalize URIs by stripping these characters before attempting to parse the scheme, an attacker can insert them into a URI string—for example, 'javascrip\tt:alert(1)'—to evade the plugin's security filters while remaining functional within the browser's execution engine.\nThe attack flow proceeds as follows: An attacker crafts a malicious SVG document incorporating an anchor element using a namespace-prefixed tag or a standard tag with a URI containing hidden whitespace control characters. When the SVGO library processes the file with the 'removeScripts' plugin enabled, the plugin fails to identify these patterns as malicious and leaves them intact in the output.\nThe optimized SVG is then stored or served by an application to a victim's browser. When the victim interacts with the rendered SVG element (e.g., clicking a link), the browser ignores the obfuscation characters, effectively reconstructing the 'javascript:' protocol. This results in the execution of the injected script within the origin of the application hosting the SVG.\nThis vulnerability is particularly dangerous when SVGO is used as part of a content upload pipeline where untrusted user input is processed and later rendered in an authenticated context. Because the browser interprets the script within the origin of the host application, the attacker can bypass Same-Origin Policy (SOP) restrictions, steal session cookies, capture CSRF tokens, or modify the DOM to facilitate further attacks.\nAffected versions include all releases from 1.0.0 through 2.8.3, 3.0.0 through 3.3.4, and 4.0.0. Exploitation does not require prior authentication or elevated privileges, provided the attacker can submit a file to be processed by an SVGO-dependent system."
}