Homepage

Cross-site Scripting (XSS) Affecting arangodb-3.12 package, versions <3.12.11-r1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.34% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-ARANGODB312-19706616
  • published13 Sept 2026
  • disclosed1 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 1 Sep 2026

NewCVE-2026-84370  (opens in a new tab)
CWE-79  (opens in a new tab)
CWE-184  (opens in a new tab)

How to fix?

Upgrade Chainguard arangodb-3.12 to version 3.12.11-r1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream arangodb-3.12 package and not the arangodb-3.12 package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.