AIKIDO-2026-858273
svgo is vulnerable to Cross-Site Scripting (XSS)
82
High Risk
This Affects:
svgoTL;DR
The opt-in removeScripts plugin fails to neutralize executable links. It does not recognize SVG anchors declared with namespace prefixes such as svg:a, and its URL scheme check does not account for ASCII tab, line feed, and carriage return characters embedded in a scheme. Because browsers strip those control characters before parsing, an obfuscated javascript: URL stays clickable. When the optimized SVG is rendered in an active browser context, the link executes script. The fix resolves namespace-prefixed anchors and normalizes control characters before matching executable schemes such as javascript:, vbscript:, and executable data: URLs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable the opt-in removeScripts plugin (named removeScriptElement on the v1-v2 lines) to sanitize untrusted SVG input.
Background info
svgo is vulnerable to Cross-Site Scripting (XSS) in versions 1.0.0 - 2.8.3, 3.0.0 - 3.3.4 and 4.0.0 - 4.0.2.
How to fix this
Upgrade the svgo library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant