Cloudanix VulnDB

CVE-2026-73650

High · 8.2

CVSS

8.2

EPSS

0.4%

Published

Aug 13, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a popular tool that cleans up SVG images can let hidden scripts survive the cleaning process, so any site that shows cleaned images uploaded by users could accidentally run code in visitors' browsers.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The removeScripts plugin fails to strip namespaced script elements such as svg:script and performs case-sensitive matching on javascript: URIs, allowing executable script to remain in the optimized SVG output.

Why it matters to the business

Organizations that accept and re-serve user-supplied SVG files after optimization may inadvertently deliver active script to other users, resulting in unauthorized access to session data or cookies stored in the browser.

How an attack unfolds

An attacker crafts an SVG containing either a namespaced script element or a mixed-case javascript: URI, submits it to an application that invokes the vulnerable SVGO plugin, and the resulting optimized file is served to a victim whose browser executes the retained script.

How to fix it

Upgrade SVGO to version 2.8.3, 3.3.4, or 4.0.2 depending on the major version in use; disable the removeScripts plugin if immediate upgrade is not feasible and perform manual script removal before serving optimized SVGs.

How to confirm the fix worked

Confirm the installed SVGO version is at or above the fixed releases, re-process a test SVG containing svg:script and mixed-case javascript: URIs, and verify that all script elements and URIs are removed from the output.

Typical attack path

  1. Attacker prepares malicious SVG embedding script via svg:script or mixed-case javascript: URI
  2. Target application processes the SVG with the removeScripts plugin enabled
  3. Optimized SVG containing executable content is stored or returned
  4. Victim opens the SVG in a browser, script executes and accesses cookies or local storage

How to detect it

Search web-server and application logs for SVGO optimization events that processed SVGs containing svg:script tags or javascript: URIs; inspect stored or cached SVG files for retained script elements after optimization.

What your security team should do

  • Immediately inventory all applications using SVGO and schedule upgrades to the patched releases
  • Add automated dependency scanning to detect future vulnerable versions of SVGO
  • Review all code paths that accept and serve SVG content and ensure sanitization occurs before delivery
  • Monitor for new exploit code or proof-of-concept releases given the public disclosure

The record

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities