CVE-2026-84370: SVGO SVG Optimizer XSS Vulnerability

CVE-2026-84370 Overview

CVE-2026-84370 is a cross-site scripting (XSS) vulnerability in SVGO, a Node.js library and command-line tool for optimizing SVG files. The opt-in removeScripts plugin (named removeScriptElement in versions 2 and 3) incompletely filters executable links. It fails to recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values. The plugin also does not strip ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Because browsers remove those characters before parsing a scheme, an attacker can smuggle a javascript: URL past the filter. The flaw affects versions from 1.0.0 up to but not including 2.8.4, 3.3.5, and 4.1.0.

Critical Impact

A victim who activates the surviving link in a rendered SVG can execute script in the SVG's origin, exposing data, modifying content, or performing actions as the victim.

Affected Products

• SVGO versions 1.0.0 through 2.8.3
• SVGO versions 3.0.0 through 3.3.4
• SVGO versions 4.0.0 through 4.0.x (prior to 4.1.0)

Discovery Timeline

• 2026-09-01 - CVE-2026-84370 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84370

Vulnerability Analysis

The vulnerability [CWE-79] resides in SVGO's sanitization logic for anchor elements inside SVG documents. The removeScripts plugin is designed to strip elements and attributes that could produce script execution when the optimized SVG is rendered in an active browser context. The isExecutableUrl function in lib/svgo/tools.js normalizes candidate URL values before checking a denylist of dangerous schemes such as javascript: and vbscript:. That normalization was incomplete.

When an application processes attacker-controlled SVG input and serves the optimized output to a user's browser, a link that survives sanitization can trigger script execution on activation. The impact is scoped to the SVG's origin, permitting data exfiltration, DOM modification, and actions performed as the authenticated victim.

Root Cause

Two defects combine to produce the bypass. First, plugins/removeScripts.js inspected anchor elements only within the default SVG namespace and did not enumerate namespace-prefixed variants such as svg:a or attributes like xlink:href. Second, isExecutableUrl applied only trimStart() and toLowerCase() before comparing prefixes. It did not remove ASCII tab (\t), line feed (\n), or carriage return (\r) characters, which browsers silently discard while parsing URL schemes.

Attack Vector

An attacker crafts an SVG containing a namespace-prefixed anchor whose href embeds control characters inside the scheme, for example ja\tvascript:alert(1). The SVG passes through SVGO's removeScripts optimization unchanged. When rendered and clicked by a victim, the browser normalizes the URL, resolves the javascript: scheme, and executes the payload.

// Security patch in lib/svgo/tools.js
// fix(removeScripts): handle anchor URL bypasses (#2268)
 * @returns {boolean}
 */
export const isExecutableUrl = (value) => {
-  const normalizedValue = value.trimStart().toLowerCase();
+  // Browsers remove ASCII tabs and newlines from URLs before parsing them.
+  // Normalize them here too so they cannot be embedded in a scheme name.
+  const normalizedValue = value
+    .replace(/[\t\n\r]/g, '')
+    .trimStart()
+    .toLowerCase();

  // `javascript:` is executable in modern browsers. `vbscript:` was only
  // implemented by legacy Internet Explorer, but rejecting it is inexpensive,

Source: SVGO Commit Bug Fix

// Security patch in plugins/removeScripts.js
/** Namespaces that support SVG <foreignObject> elements. */
const FOREIGN_OBJECT_NAMESPACES = [SVG_NAMESPACE];

+/** Namespaces that support SVG <a> elements. */
+const ANCHOR_NAMESPACES = [SVG_NAMESPACE];
+
/** Namespaces that support executable <script> elements. */
const SCRIPT_NAMESPACES = [SVG_NAMESPACE, 'http://www.w3.org/1999/xhtml'];

Source: SVGO Pull Request #2268

Detection Methods for CVE-2026-84370

Indicators of Compromise

• SVG assets served from the application that contain <a> or svg:a elements with href or xlink:href values beginning with control characters followed by javascript: or vbscript:.
• Web server logs showing SVG uploads followed by outbound requests to attacker-controlled domains from user sessions.
• Content Security Policy (CSP) violation reports referencing inline script execution in SVG-hosting origins.

Detection Strategies

• Scan stored SVG assets for anchor elements whose href attribute matches the regex [\t\n\r]*(javascript|vbscript): after normalization.
• Inspect package-lock.json and yarn.lock for SVGO versions prior to 2.8.4, 3.3.5, or 4.1.0 and flag builds that transitively include them.
• Add unit tests that pass known bypass payloads through the SVGO pipeline and assert the output does not contain executable URLs.

Monitoring Recommendations

• Enable CSP with script-src 'self' and a reporting endpoint to surface unexpected inline execution triggered from SVG contexts.
• Log and alert on user activations of anchors in user-supplied SVG content served from trusted origins.
• Track software composition analysis (SCA) findings for the svgo npm package across CI/CD pipelines.

How to Mitigate CVE-2026-84370

Immediate Actions Required

• Upgrade SVGO to 2.8.4, 3.3.5, or 4.1.0 depending on the major version in use.
• Rebuild and redeploy any application, static-site generator, or asset pipeline that bundles SVGO transitively.
• Re-run SVGO across previously optimized SVG assets that originated from untrusted sources and replace stored outputs.

Patch Information

Maintainers released fixes across three supported branches. See the SVGO Security Advisory GHSA-w27v-7q3p-w38r and the tagged releases v2.8.4, v3.3.5, and v4.1.0. The v3 backport is described in SVGO Pull Request #2269. The changes expand namespace coverage for anchors and strip ASCII tabs, line feeds, and carriage returns before scheme checks.

Workarounds

• Disable the removeScripts / removeScriptElement plugin and enforce a separate allowlist-based SVG sanitizer such as DOMPurify configured for SVG.
• Serve user-supplied SVG content from a sandboxed origin with a strict Content Security Policy that blocks inline script execution.
• Reject uploaded SVGs containing anchor elements or href attributes at the application layer until the upgrade is deployed.

# Upgrade SVGO to a patched release
npm install svgo@^4.1.0
# or, for the v3 branch
npm install svgo@^3.3.5
# or, for the v2 branch
npm install svgo@^2.8.4

# Verify installed version
npm ls svgo