The CVE-2026-84370 vulnerability in the SVGO library allows for the incomplete removal of executable links in SVG files, which can lead to script execution in the SVG's origin when an application serves the processed SVG in an active browser context. This issue arises from the library's failure to properly filter executable links, particularly those with namespace-prefixed SVG anchor elements or those con [truncated]
The SVGO library and command-line application, used for optimizing SVG files, had a vulnerability in versions 1.0.0 until 2.8.3, 3.3.4, and 4.0.2. The removeScripts plugin could leave executable content in optimized SVGs, allowing scripts to execute when another user opens the SVG. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2. The vulnerability allows scripts to execute in optimized SVGs, poten [truncated]
