CVE-2026-29074
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
SVGO, a Node.js library for optimizing SVG files, is vulnerable to an XML Entity Expansion (XML bomb) attack. From version 2.1.0 to before 2.8.1, from 3.0.0 to before 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities without guards against entity expansion or recursion. A small XML file (811 bytes) can stall the application and crash the Node.js process with JavaScript heap out of memory.
Risk Assessment
An attacker can send a specially crafted SVG file that exhausts JavaScript heap memory, causing a denial of service (DoS) and crashing the application using SVGO.
Recommendation
Immediately update SVGO to version 2.8.1, 3.3.3, or 4.0.1, depending on your major version. This will patch the vulnerability.
Other vulnerabilities in SVGO
See all- CVE-2026-84370High
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim.
- CVE-2026-84369Medium
In SVGO (SVG Optimizer) from version 1.0.0 to versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin (removeScriptElement in versions 2 and 3) removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
- CVE-2026-73650High
SVGO (SVG Optimizer) is a Node.js library and CLI for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin (removeScriptElement in versions 1-3) can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications processing untrusted SVG input with this plugin enabled and serving the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. Fixed in versions 2.8.3, 3.3.4, and 4.0.2.
Original NVD description (English source)
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.