SVGO Vulnerability: Incomplete Script Removal Leading to Potential XSS Attacks
Summary
GHSA-2p49-hgcm-8545: SVGO removeScripts plugin leaves some executable scripts intact. Affects svgo across 3 version ranges.
>= 1.0.0, < 2.8.3
>= 3.0.0, < 3.3.4
>= 4.0.0, < 4.0.2
Fixed in 2.8.3, 3.3.4 or 4.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SVGO (SVG Optimizer) is a Node.js-based tool used to optimize SVG files by removing unnecessary data, thereby reducing file size and improving performance. It includes various plugins, one of which is the removeScripts plugin, designed to eliminate executable scripts from SVG files. However, this plugin has a flaw that allows certain scripts to remain intact, posing a security risk.
Vulnerability Detail
The vulnerability arises from the removeScripts plugin of SVGO, which is intended to sanitize SVG files by removing script elements. However, it fails to remove namespaced or prefixed script elements, such as svg:script, and does not handle case sensitivity for JavaScript URIs. This oversight can lead to Cross-Site Scripting (XSS) attacks if an attacker embeds malicious scripts within SVG files that are processed by SVGO and served to users. The vulnerability is particularly concerning for applications that rely on SVGO for sanitization of user-uploaded SVGs.
How To Fix
Latest published version: 4.1.0 as of 23 Oct 2026
npm install svgo@4.1.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 2.8.32.8.3npm install svgo@2.8.3 -
>= 3.0.0, < 3.3.43.3.4npm install svgo@3.3.4 -
>= 4.0.0, < 4.0.24.0.2npm install svgo@4.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you need to sanitize SVGs and cannot upgrade SVGO, consider using a dedicated SVG sanitization tool before passing the SVG to SVGO. This will help ensure that all executable scripts are removed before optimization.
Conclusion
The SVGO vulnerability related to the removeScripts plugin poses a significant risk of XSS attacks due to its failure to remove certain script elements from SVG files. Users are strongly advised to update to the latest patched versions of SVGO or implement alternative sanitization methods to mitigate this risk.
See every vulnerability recorded for svgo →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
SVGO versions 1.0.0 to 1.3.2, 2.0.0 to 2.8.2, 3.0.0 to 3.3.4, and 4.0.0 to 4.0.1 are affected by this vulnerability.
If upgrading is not an option, consider using a dedicated SVG sanitization tool to remove scripts before processing with SVGO.
If exploited, this vulnerability could allow attackers to execute scripts in the context of a user's browser, potentially accessing sensitive information like cookies or local storage.
References
Related vulnerabilities
Recent vulnerabilities recorded for svgo.
