chore(deps): update dependency svgo@^3.0.0 to v3.3.5 [security] - #1271
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Coverage Report for CI Build 34759740392Coverage remained the same at 96.85%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
renovate
Bot
force-pushed
the
renovate/npm-svgo-3.0.0-vulnerability
branch
from
September 13, 2026 13:24
05ff9c9 to
abbd59c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.3.4→3.3.5SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
CVE-2026-84369 / GHSA-4vpr-x523-8j87
More information
Details
Summary
SVGO's opt-in
removeScriptsplugin did not inspect executable HTML content inside SVG<foreignObject>elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS).SVGO is an optimizer rather than a comprehensive sanitization library, but
removeScriptsis maintained for consumers that already rely on it to remove common script execution paths.Details
Although the plugin removed SVG and XHTML
<script>elements, it left other HTML execution paths inside<foreignObject>unchanged. These included:onloadandonbeforetoggle;srcdocdocuments, including on<iframe>elements;action,data,formaction,href, andsrc.An attacker could place one of these payloads in an SVG. If an application optimized the untrusted SVG with
removeScriptsand then served the result in an active browser context, the payload could execute in the viewer's origin.Impact
Successful exploitation could allow script execution in the context where the optimized SVG is rendered. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.
The plugin is opt-in, so consumers that do not enable
removeScriptsare not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.Patches
Upgrade to one of the following releases for the maintained release line in use:
removeScriptElementremoveScriptElementremoveScriptsThe fix preserves visual HTML inside SVG
<foreignObject>elements while removing event attributes,srcdoc, and executable URL values from active HTML URL attributes.SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.
Workarounds
For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. As defense in depth, applications can reject or remove
<foreignObject>content and avoid serving user-controlled SVGs in an active same-origin context.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SVGO: removeScripts allows executable links through namespace and control-character bypasses
CVE-2026-84370 / GHSA-w27v-7q3p-w38r
More information
Details
Summary
SVGO's opt-in
removeScriptsplugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).SVGO is an optimizer rather than a comprehensive sanitization library, but
removeScriptsis maintained for consumers that already rely on it to remove common script execution paths.Details
Two related bypasses were present:
<a>elements but did not recognize namespace-prefixed SVG anchors such as<svg:a>when the prefix was bound to the SVG namespace. Their executablehrefor namespaced*:hrefvalues remained intact.java&#​9;script:could remain executable after bypassing the plugin'sjavascript:check.Anchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.
Impact
If an application optimized attacker-controlled SVGs with
removeScriptsand then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.The plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.
Patches
Upgrade to one of the following releases for the maintained release line in use:
removeScriptElementremoveScriptElementremoveScriptsThe fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.
SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.
Workarounds
For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.
References
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
svg/svgo (svgo@^3.0.0)
v3.3.5Compare Source
What's Changed
Security
removeScriptElementhardening from SVGO v4 in #2269:data:URLs and legacyvbscript:URLs<foreignObject>elementsThis addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.
Support
SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.
See the migration guide from v3 to v4.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.