{"cve":"CVE-2026-84369","nvd":{"published":"2026-09-01T21:18:48.037","modified":"2026-09-09T21:09:13.080","status":"Deferred","description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327","https://github.com/svg/svgo/pull/2264","https://github.com/svg/svgo/pull/2269"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:50.842544443+00:00"},"epss":{"cve":"CVE-2026-84369","score":0.0043,"percentile":0.3723,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4vpr-x523-8j87","url":"https://osv.dev/vulnerability/GHSA-4vpr-x523-8j87","summary":"SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements","modified":"2026-09-08T21:30:05.558835894Z","packages":[{"ecosystem":"npm","name":"svgo","purl":"pkg:npm/svgo","ranges":[">=1.0.0 <2.8.4"],"fixed":["2.8.4"]},{"ecosystem":"npm","name":"svgo","purl":"pkg:npm/svgo","ranges":[">=3.0.0 <3.3.5"],"fixed":["3.3.5"]},{"ecosystem":"npm","name":"svgo","purl":"pkg:npm/svgo","ranges":[">=4.0.0 <4.1.0"],"fixed":["4.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}