AIKIDO-2026-858273

svgo is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-w27v-7q3p-w38r Published Aug 26, 2026

High Risk

This Affects:

svgo

1.0.0 - 2.8.3

Fixed in 2.8.4

3.0.0 - 3.3.4

Fixed in 3.3.5

4.0.0 - 4.0.2

Fixed in 4.1.0

Are you affected? Scan for Free

TL;DR

The opt-in removeScripts plugin fails to neutralize executable links. It does not recognize SVG anchors declared with namespace prefixes such as svg:a, and its URL scheme check does not account for ASCII tab, line feed, and carriage return characters embedded in a scheme. Because browsers strip those control characters before parsing, an obfuscated javascript: URL stays clickable. When the optimized SVG is rendered in an active browser context, the link executes script. The fix resolves namespace-prefixed anchors and normalizes control characters before matching executable schemes such as javascript:, vbscript:, and executable data: URLs.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you enable the opt-in removeScripts plugin (named removeScriptElement on the v1-v2 lines) to sanitize untrusted SVG input.