---
id: CVE-2026-84369
title: >-
  SVGO, short for SVG Optimizer, is a Node.js library and command-line
  application for optimizing SVG files
summary: >-
  SVGO, short for SVG Optimizer, is a Node.js library and command-line
  application for optimizing SVG files. From version 1.0.0 until versions 2.8.4,
  3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement
  in versions …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: svgo
product: svgo
affected:
  - 'svgo >= 1.0.0, < 2.8.4'
  - 'svgo >= 3.0.0, < 3.3.5'
  - 'svgo >= 4.0.0, < 4.1.0'
patched:
  - svgo 2.8.4
  - svgo 3.3.5
  - svgo 4.1.0
published: '2026-09-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84369'
references:
  - url: >-
      https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c
    label: security-advisories@github.com
  - url: >-
      https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f
    label: security-advisories@github.com
  - url: >-
      https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327
    label: security-advisories@github.com
  - url: 'https://github.com/svg/svgo/pull/2264'
    label: security-advisories@github.com
  - url: 'https://github.com/svg/svgo/pull/2269'
    label: security-advisories@github.com
  - url: 'https://github.com/svg/svgo/pull/2272'
    label: security-advisories@github.com
  - url: 'https://github.com/svg/svgo/releases/tag/v2.8.4'
    label: security-advisories@github.com
  - url: 'https://github.com/svg/svgo/releases/tag/v3.3.5'
    label: security-advisories@github.com
  - url: 'https://github.com/svg/svgo/releases/tag/v4.1.0'
    label: security-advisories@github.com
  - url: 'https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84369'
  - url: 'https://github.com/advisories/GHSA-4vpr-x523-8j87'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.0043
epssPercentile: 0.34675
aliases:
  - GHSA-4vpr-x523-8j87
ecosystem: npm
ingestedAt: '2026-09-08T22:12:30.968Z'
---

## Overview

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84369)

Affected packages:

- `svgo >= 1.0.0, < 2.8.4`
- `svgo >= 3.0.0, < 3.3.5`
- `svgo >= 4.0.0, < 4.1.0`

Patched in:

- `svgo 2.8.4`
- `svgo 3.3.5`
- `svgo 4.1.0`

Source: https://github.com/advisories/GHSA-4vpr-x523-8j87