Skip to content

chore(deps): update dependency svgo to v4.1.0 [security] - #5768

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-svgo-vulnerability
Open

chore(deps): update dependency svgo to v4.1.0 [security]#5768
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-svgo-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Mar 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
svgo (source) 4.0.0 → 4.1.0 age confidence

SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)

CVE-2026-29074 / GHSA-xpqw-6gx7-v673

More information

Details

Summary

SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory.

Details

The upstream XML parser (sax) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the DOCTYPE, inserting them into parser.ENTITIES, and enabled unparsedEntities. This gives us the desired behavior of supporting SVGs with entities declared in the DOCTYPE.

However, entities can reference other entities, which can enable small SVGs to explode exponentially when we try to parse them.

Proof of Concept
import { optimize } from 'svgo';

/** Presume that this string was obtained in some other way, such as network. */
const original = `
  <?xml version="1.0"?>
  <!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ELEMENT lolz (#PCDATA)>
  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
  ]>
  <lolz>&lol9;</lolz>
`;

optimize(original);
Impact

If SVGO is run on untrusted input (i.e., user uploaded to server-side application), then the untrusted SVG can effectively stall or crash the application with an SVG < 1 KB in size.

It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.

Patches

SVGO has patched v4.0.1, v3.3.3, and v2.8.1! However, it's strongly recommended to upgrade to v4 regardless, as previous versions are not officially supported anymore.

Workarounds
== 4.0.0

For v4, users do not specifically have to upgrade SVGO, though it is recommended to do so. A package manager can be used to upgrade sax recursively:

For example:

yarn up -R sax

New options were introduced upstream which makes the way SVGO parses SVGs safe by default.

>= 2.1.0, <= 3.3.2

Users of v3 and v2 will have to take manual action. If users can't upgrade, they may be able to work around this as long as the project doesn't require support for custom XML entities, though it's not a simple flag.

Parse the DOCTYPE directly and check for the presence of custom entities. If entities are present, throw/escape before passing them to SVGO.

+ import SAX from 'sax';
  import { optimize } from 'svgo';

- const original =`
+ let original = `
    <?xml version="1.0"?>
    <!DOCTYPE lolz [
    <!ENTITY lol "lol">
    <!ELEMENT lolz (#PCDATA)>
    <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
    <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
    <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
    <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
    <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
    <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
    <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
    <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
    <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
    ]>
    <lolz>&lol9;</lolz>
  `;

+ const parser = SAX.parser();
+ /** @param {string} doctype */
+ parser.ondoctype = (doctype) => {
+   original = original.replace(doctype, '');
+ }
+ parser.write(original);

  optimize(original);
Resources

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

SVGO removeScripts plugin leaves some executable scripts intact

CVE-2026-73650 / GHSA-2p49-hgcm-8545

More information

Details

Summary

SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.

Details

SVGO has a plugin for removing scripts from an SVG, which removes:

  • <script> elements
  • JavaScript URIs (v4 and v3 only)
  • on… event handlers (v4 and v3 only)

While SVGO is not a sanitization library, SVGO continues to maintain the plugin for those already using it for this purpose.

However, there were two problems:

  • SVGO did not check namespaced/prefixed script elements, for example if one declared an explicit prefix for the SVG namespace ( <svg:script>) instead of using the default namespace ( <script>), the <svg:script> tag would be left intact.
  • SVGO case sensitively matched JavaScript URIs, but it should've been case-insensitive.
Proof of Concept
import { optimize } from 'svgo';

/** Presume that this string was obtained in some other way, such as network. */
const original = `
  <svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" xmlns:uwu="http://www.w3.org/1999/xlink" viewBox="0 0 100 100" version="1.1">
    <a uwu:href="JavaScript:(() =&gt; { alert(document.cookie) })();"><text y="30">uwu</text></a>
    <svg:script>
      alert(document.cookie);
    </svg:script>
  </svg>
`;

optimize(original, {
  plugins: ['removeScripts']
});
// Did not remove <svg:script> or uwu:href="JavaScript:…—still executed by browsers.
Impact

If you run SVGO on untrusted input (e.g., user uploads to a web application) and you depended on removeScripts, then some scripts may still be present. If that SVG was then opened directly by another user on the same domain, it could invoke scripts that could read local storage or cookies.

This may affect you if you have enabled one of the following:

SVGO Version Plugin Name
v4 removeScripts
v3 removeScriptElement
v2 removeScriptElement
v1 removeScriptElement

It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.

Patches
>= 3.0.0, <= 4.0.1

SVGO patched v4.0.2 and v3.3.4. Just upgrade the dependency using your preferred package manager! For example:

yarn up svgo

##### or if SVGO is a nested dependency
yarn up -R svgo

The proposed fix is to improve our namespace-aware handling to explicitly act on the default namespace, SVG namespace, and XHTML namespace only. This handles all scripts that are executed by browsers, but will leave intact custom prefixes that happen to have an element called <*:script> which clients shouldn't treat as executable.

>= 2.0.0, <= 2.8.2

SVGO patched v2.8.3, however SVGO v2 explicitly only implements and documents that it will remove <script> elements and nothing more. It has the namespace aware handling for tags like <svg:script> or <xhtml:script>, but has not been updated to remove JavaScript URIs or event handlers like >= v3. If this is something you need, please upgrade to v4 or v3, or reach for one of the documented workarounds at the end.

>= 1.0.0, <= 1.3.2

SVGO v1 has been deprecated for a while now and won't be patched. Please upgrade to a more recent version! If something is preventing you from doing so, please reach out! We're happy to expand our migration guides or support you if you're having trouble.

Workarounds

If your motivation for enabling the plugin is SVG sanitization, consider reaching for a dedicated SVG sanitization tool and invoke it before passing the SVG to SVGO.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

SVGO: removeScripts allows executable links through namespace and control-character bypasses

CVE-2026-84370 / GHSA-w27v-7q3p-w38r

More information

Details

Summary

SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).

SVGO is an optimizer rather than a comprehensive sanitization library, but removeScripts is maintained for consumers that already rely on it to remove common script execution paths.

Details

Two related bypasses were present:

  1. The plugin inspected unprefixed SVG <a> elements but did not recognize namespace-prefixed SVG anchors such as <svg:a> when the prefix was bound to the SVG namespace. Their executable href or namespaced *:href values remained intact.
  2. The URL check did not account for ASCII tab, line-feed, or carriage-return characters embedded in a scheme. Browsers remove these characters before parsing the scheme, so values such as java&#&#8203;9;script: could remain executable after bypassing the plugin's javascript: check.

Anchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.

Impact

If an application optimized attacker-controlled SVGs with removeScripts and then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.

The plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.

Patches

Upgrade to one of the following releases for the maintained release line in use:

Release line Patched version Plugin
v2 2.8.4 removeScriptElement
v3 3.3.5 removeScriptElement
v4 4.1.0 removeScripts

The fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.

SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.

Workarounds

For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.

References

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

CVE-2026-84369 / GHSA-4vpr-x523-8j87

More information

Details

Summary

SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG <foreignObject> elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS).

SVGO is an optimizer rather than a comprehensive sanitization library, but removeScripts is maintained for consumers that already rely on it to remove common script execution paths.

Details

Although the plugin removed SVG and XHTML <script> elements, it left other HTML execution paths inside <foreignObject> unchanged. These included:

  • event-handler attributes such as onload and onbeforetoggle;
  • srcdoc documents, including on <iframe> elements;
  • executable URLs in HTML attributes such as action, data, formaction, href, and src.

An attacker could place one of these payloads in an SVG. If an application optimized the untrusted SVG with removeScripts and then served the result in an active browser context, the payload could execute in the viewer's origin.

Impact

Successful exploitation could allow script execution in the context where the optimized SVG is rendered. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.

The plugin is opt-in, so consumers that do not enable removeScripts are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.

Patches

Upgrade to one of the following releases for the maintained release line in use:

Release line Patched version Plugin
v2 2.8.4 removeScriptElement
v3 3.3.5 removeScriptElement
v4 4.1.0 removeScripts

The fix preserves visual HTML inside SVG <foreignObject> elements while removing event attributes, srcdoc, and executable URL values from active HTML URL attributes.

SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.

Workarounds

For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. As defense in depth, applications can reject or remove <foreignObject> content and avoid serving user-controlled SVGs in an active same-origin context.

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

svg/svgo (svgo)

v4.1.0

Compare Source

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#​2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

  • disallowed control characters such as &#&#8203;1;, &#xB;, and &#x1F;;
  • UTF-16 surrogate code points such as &#xD800;;
  • invalid XML code points such as &#xFFFF;.

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#​2263).
  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#​2264).
  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&#&#8203;9;script: from bypassing detection while preserving elements in unrelated custom namespaces (#​2268).

These changes address:

Dependencies
  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#​2244).
Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

v4.0.2

Compare Source

What's Changed

Security
Bug Fixes
Performance
Other Changes

v4.0.1

Compare Source

What's Changed

Dependencies
  • Sets minimum version of sax (XML parser) to v1.5.0, which improves built-in guards against entity expansion.
Bug Fixes
Performance
Other Changes
  • Plugins no longer include if they are enabled or disabled by default, as this was written inconsistently. The --show-plugins argument appends the presets a plugin is in to the end of the line. By @​viralcodex in #​2174
  • Plugin/preset types to enforce the name start with preset- if it is a preset (collection of plugins). By @​SethFalco in #​2178

Metrics

Before and after of the browser bundle of each respective version:

v4.0.0 v4.0.1 Delta
svgo.browser.js 780.2 kB 781.5 kB ⬆️ 1.3 kB

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@webteam-app

webteam-app commented Mar 5, 2026

Copy link
Copy Markdown

Demo

Jenkins

demos.haus

@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from bb02a02 to dc73b41 Compare March 13, 2026 12:29
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from dc73b41 to 0c1eb42 Compare March 25, 2026 08:04
@renovate renovate Bot changed the title chore(deps): update dependency svgo to v4.0.1 [security] chore(deps): update dependency svgo to v4.0.1 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/npm-svgo-vulnerability branch March 27, 2026 02:45
@renovate renovate Bot changed the title chore(deps): update dependency svgo to v4.0.1 [security] - autoclosed chore(deps): update dependency svgo to v4.0.1 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 3 times, most recently from 1f38baf to f120bf6 Compare April 4, 2026 13:10
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from f120bf6 to 7cd7738 Compare April 8, 2026 13:12
@renovate renovate Bot changed the title chore(deps): update dependency svgo to v4.0.1 [security] Update dependency svgo to v4.0.1 [SECURITY] Apr 8, 2026
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from 7cd7738 to 01df368 Compare April 16, 2026 07:07
@renovate renovate Bot changed the title Update dependency svgo to v4.0.1 [SECURITY] chore(deps): update dependency svgo to v4.0.1 [security] Apr 17, 2026
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 2 times, most recently from 90551af to bc4c797 Compare April 23, 2026 03:47
@renovate renovate Bot changed the title chore(deps): update dependency svgo to v4.0.1 [security] chore(deps): update dependency svgo to v4.0.1 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title chore(deps): update dependency svgo to v4.0.1 [security] - autoclosed chore(deps): update dependency svgo to v4.0.1 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 3 times, most recently from 24e185c to 6cd7bed Compare April 29, 2026 07:16
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 3 times, most recently from e536be6 to c70654a Compare May 8, 2026 12:22
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from c70654a to 0e51b6a Compare May 20, 2026 08:16
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from 0e51b6a to 306037a Compare June 9, 2026 14:59
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 3 times, most recently from 588e409 to 1085abb Compare June 15, 2026 11:37
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 4 times, most recently from f53effb to 961d529 Compare June 26, 2026 11:52
@renovate renovate Bot changed the title chore(deps): update dependency svgo to v4.0.1 [security] chore(deps): update dependency svgo to v4.0.2 [security] Jul 24, 2026
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 3 times, most recently from 3556fbd to 11876ea Compare July 24, 2026 21:29
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 2 times, most recently from 9e8f5de to 59bd8b2 Compare August 21, 2026 15:06
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 2 times, most recently from f31379c to 2775e7a Compare August 27, 2026 12:10
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from 2775e7a to a4f964e Compare September 9, 2026 04:05
@renovate renovate Bot changed the title chore(deps): update dependency svgo to v4.0.2 [security] chore(deps): update dependency svgo to v4.1.0 [security] Sep 9, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Maintenance 🔨

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@webteam-app