---
id: "CVE-2026-84370"
kind: "vulnerability"
aliases: ["CVE-2026-84370", "GHSA-w27v-7q3p-w38r"]
title: "SVGO: removeScripts allows executable links through namespace and control-character bypasses"
severity: "high"
cvss: 8.2
epss: 0.00525
exploited: false
status: "open"
category: "package"
products: [{"name": "svgo", "fixed": ["2.8.4"], "affected": ">= 1.0.0, < 2.8.4", "ecosystem": "npm"}, {"name": "svgo", "fixed": ["3.3.5"], "affected": ">= 3.0.0, < 3.3.5", "ecosystem": "npm"}, {"name": "svgo", "fixed": ["4.1.0"], "affected": ">= 4.0.0, < 4.1.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-184", "cwe-79", "node", "npm", "package", "svg-upload", "svgo", "web-apps"]
not_affected_if: ["default-config", "plugin-not-enabled", "trusted-input-only"]
published_at: "2026-09-01T21:18:48+00:00"
first_seen_at: "2026-10-26T23:54:12+00:00"
updated_at: "2026-10-26T23:55:48+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-w27v-7q3p-w38r", "first_seen_at": "2026-10-26T23:54:12+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84370", "first_seen_at": "2026-10-26T23:55:48+00:00"}]
---

# SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO's opt-in removeScripts plugin leaves some executable SVG links in place when the anchor uses a namespace prefix or the URL scheme contains tab or newline characters. If an application optimizes untrusted SVGs with this plugin and serves the output in an active browser context, a victim who follows a link can run script in the SVG's origin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:svgo affected >= 1.0.0, < 2.8.4 fixed 2.8.4
- npm:svgo affected >= 3.0.0, < 3.3.5 fixed 3.3.5
- npm:svgo affected >= 4.0.0, < 4.1.0 fixed 4.1.0

## How to check

- Run `npm ls svgo` to list the installed SVGO versions and find which ones are below `2.8.4`, `3.3.5` or `4.1.0`.
- Search the project for `removeScripts` or `removeScriptElement` to see whether the plugin is enabled in the SVGO config.
- Check whether untrusted SVG uploads are optimized with SVGO and then served from the same origin as the app.

## Fix

- Upgrade SVGO to `2.8.4` on the v2 line, `3.3.5` on the v3 line, or `4.1.0` on the v4 line.
- Upgrade off SVGO v1, which is no longer maintained.
- For hostile input, run a dedicated SVG sanitizer before SVGO, or reject links from untrusted SVG input.

## Timeline

- 2026-10-26T23:54:12+00:00 ghsa https://github.com/advisories/GHSA-w27v-7q3p-w38r
- 2026-10-26T23:55:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84370

## From the sources

## Summary

SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).

SVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths.

## Details

Two related bypasses were present:

1. The plugin inspected unprefixed SVG `<a>` elements but did not recognize namespace-prefixed SVG anchors such as `<svg:a>` when the prefix was bound to the SVG namespace. Their executable `href` or namespaced `*:href` values remained intact.
2. The URL check did not account for ASCII tab, line-feed, or carriage-return characters embedded in a scheme. Browsers remove these characters before parsing the scheme, so values such as `java&#9;script:` could remain executable after bypassing the plugin's `javascript:` check.

Anchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.

## Impact

If an application optimized attacker-controlled SVGs with `removeScripts` and then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.

The plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.

## Patches

Upgrade to one of the following releases for the maintained release line in use:

| Release line | Patched version | Plugin |
| --- | --- | --- |
| v2 | 2.8.4 | `removeScriptElement` |
| v3 | 3.3.5 | `removeScriptElement` |
| v4 | 4.1.0 | `removeScripts` |

The fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.

SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.

## Workarounds

For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.

## References

- v4 fix: https://github.com/svg/svgo/pull/2268
- related executable URL hardening: https://github.com/svg/svgo/pull/2263
- v3 backport: https://github.com/svg/svgo/pull/2269
- v2 backport: https://github.com/svg/svgo/pull/2272
- v4.1.0 release: https://github.com/svg/svgo/releases/tag/v4.1.0
- v3.3.5 release: https://github.com/svg/svgo/releases/tag/v3.3.5
- v2.8.4 release: https://github.com/svg/svgo/releases/tag/v2.8.4

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_