CVE-2026-84370

A flaw was found in SVGO (SVG Optimizer), a Node.js library for optimizing SVG files. The removeScripts plugin, intended to filter executable links, incompletely processes namespace-prefixed SVG anchor elements and fails to remove ASCII control characters before validating URL schemes. A remote attacker could craft a malicious SVG file that, when processed by an application and served in a browser, allows for arbitrary script execution in the SVG's origin if a victim activates the embedded link. This could lead to information disclosure, content modification, or unauthorized actions performed as the victim.

A flaw was found in SVGO's removeScripts plugin (opt-in), which is designed to filter executable links from SVG files. The plugin incompletely handles namespace-prefixed SVG anchor elements (e.g., svg:a) and fails to remove ASCII control characters (tab, line-feed, carriage-return) before validating URL schemes. When an application enables this plugin to process untrusted SVG input and serves the result in a browser context, an attacker can craft a malicious SVG that bypasses the filter. If a victim activates the embedded link, arbitrary script can execute in the SVG's origin, potentially leading to information disclosure, content modification, or unauthorized actions.

Red Hat Product Security has determined that the impact of this flaw is Important. Most Red Hat products that bundle SVGO do not use it for SVG processing or do not enable the removeScripts plugin. The affected products have been identified and are receiving updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.