CVE-2026-84369

A flaw was found in SVGO, a tool designed to optimize SVG (Scalable Vector Graphics) files. The removeScripts feature, which is meant to remove potentially harmful code, fails to fully sanitize executable HTML content embedded within SVG foreignObject elements. This oversight could allow a remote attacker to create a specially crafted SVG file. When this file is processed by SVGO and then viewed in a web browser, it could enable the attacker to run unauthorized scripts, potentially exposing sensitive data or performing actions on behalf of the user.

Red Hat has evaluated this vulnerability as having a Moderate severity because exploitation requires an application to accept untrusted SVG files, rely specifically on the opt-in script removal plugin for sanitization, and serve the result within an active web session. In supported Red Hat environments, SVGO is typically utilized for build-time asset optimization and trusted graphics rather than serving as a real-time web input sanitizer. Therefore, successful exploitation requires uncommon application workflows processing attacker-supplied files and user interaction to execute arbitrary script in the victim's browser.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.