Skip to content
OpenAdvisories

Package · Debian

node-svgo

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.2
    CVE-2026-84370

    SVGO: removeScripts allows executable links through namespace and control-character bypasses

    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely …

    svg svgo svgo node-svgo Debian npm
  • Medium 6.1
    CVE-2026-84369

    SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemente…

    svg svgo node-svgo svgo Debian npm
  • High 8.2
    CVE-2026-73650

    SVGO: removeScripts plugin leaves some executable scripts intact

    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave execut…

    svg svgo svgo node-svgo Debian npm
  • High 7.5
    CVE-2026-29074

    SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities,…

    svg svgo svgo node-svgo Debian npm