Skip to content
Fencer Vulns
medium 6.1

CVE-2026-84369 json

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

published 2026-09-01 2 mo ago modified 2026-09-09 1 mo ago also GHSA-4vpr-x523-8j87 , EUVD-2026-69651

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Patch / fix

  • npm svgo 2.8.4, 3.3.5, 4.1.0
  • node-svgo Debian 14 3.3.5+ds-1

debian advisories DEBIAN-CVE-2026-84369

  • agama-web-ui openSUSE Tumbleweed 25+475.275dd4727-56.1
  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1

opensuse advisories openSUSE-SU-2026:12424-1openSUSE-SU-2026:12070-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84369 updated cvss 6.1

svgo: SVGO: Cross-Site Scripting (XSS) vulnerability in SVG foreignObject processing

  • Red Hat Cryostat 4 cryostat/cryostat-openshift-console-plugin-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8 Red Hat AMQ Broker 7 amq-broker-bin.zip, amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8
    +19 more products
    Red Hat build of Apache Camel for Spring Boot 4 rhaf-camel-spring-boot-maven-repository.zip, rhaf-camel-for-springboot-maven-repository.zip Red Hat Build of Podman Desktop rh-podman-desktop Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf Red Hat Data Grid 8 redhat-datagrid-maven-repository.zip Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 7 rhsm-gtk, python-syspurpose, subscription-manager, subscription-manager-gui, subscription-manager-rhsm, subscription-manager-cockpit, +5 more Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-pcp, grafana-loki, +12 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-pcp, grafana-selinux Red Hat Enterprise Linux 10 grafana, grafana-pcp Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 svgo Red Hat Hardened Images grafana12.4, grafana13.1, grafana13.2, prometheus3.13 Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9 Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel9 Red Hat Quay 3 quay/quay-rhel8 Red Hat Single Sign-On 7 rh-sso-server-dist.zip Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    under investigation

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm svgo
>=1.0.0, <2.8.4
>=3.0.0, <3.3.5
>=4.0.0, <4.1.0
2.8.4
3.3.5
4.1.0

Affected products

  • svg svgo

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.