CVE-2026-84370

CVE-2026-84370 is a cross-site scripting flaw (CWE-79/CWE-184) in the SVGO (SVG Optimizer) npm package, in the opt-in removeScripts plugin — named removeScriptElement in versions 2 and 3 — which incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin fails to recognize namespace-prefixed anchor elements (such as svg:a with href or namespaced *:href values) and does not strip ASCII tab, line-feed, or carriage-return characters before checking URL schemes; because browsers remove those characters when parsing the scheme, a crafted executable link survives optimization. When an application processes attacker-controlled SVG with the plugin enabled and serves the result in an active browser context, a victim who activates the surviving link executes script in the SVG's origin, allowing data exposure, content modification, or actions performed as the victim. Any npm-based application, CLI workflow, or build pipeline using SVGO from version 1.0.0 up to the fixed versions with the plugin enabled is affected. Exploitation is not currently observed: the issue is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade SVGO to at least 2.8.4 on the 2.x line, 3.3.5 on the 3.x line, or 4.1.0 on the 4.x line. If upgrading is not immediate, disable the opt-in removeScripts/removeScriptElement plugin for untrusted SVG input, or avoid serving its output in an active browser context. Audit dependency and configuration files (e.g., imagemin/svgo wrappers) to find where the plugin is enabled implicitly, and run a dependency scan for vulnerable SVGO versions.