CVE-2026-73650 svg CVE debrief

Who should care

Defenders processing untrusted SVG input with SVGO, especially in applications serving optimized SVGs, should assess exposure and update to a fixed SVGO version. Defenders should verify and update SVGO to a fixed version to prevent script execution. The vulnerability allows scripts to execute in optimized SVGs, potentially exposing local storage or cookies.

Why it matters

The SVGO vulnerability allows scripts to execute in optimized SVGs, potentially exposing local storage or cookies. Defenders should prioritize verifying and updating SVGO to a fixed version, especially if processing untrusted SVG input.

• Scripts may execute when another user opens the SVG, potentially exposing local storage or cookies.
• Defenders should verify and update SVGO to a fixed version to prevent script execution.
• Input validation and sanitization for SVG files are crucial to prevent potential attacks.

Technical summary

The removeScripts plugin in SVGO versions 1.0.0 until 2.8.3, 3.3.4, and 4.0.2 could leave executable content in optimized SVGs, allowing scripts to execute when another user opens the SVG. The vulnerability allows scripts to execute in optimized SVGs, potentially exposing local storage or cookies. Defenders should prioritize verifying and updating SVGO to a fixed version, especially if processing untrusted SVG input. The issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2. The vulnerability was reported by [email protected].

Defensive priority

Defenders should prioritize verifying and updating SVGO to a fixed version, especially if processing untrusted SVG input.

Recommended defensive actions

• Verify and update SVGO to a fixed version (2.8.3, 3.3.4, or 4.0.2) if processing untrusted SVG input
• Implement input validation and sanitization for SVG files
• Monitor for and restrict potentially malicious SVG uploads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The vulnerability was reported by [email protected] and affects SVGO versions 1.0.0 until 2.8.3, 3.3.4, and 4.0.2. The issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2. Defenders should verify and update SVGO to a fixed version to prevent script execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.