Homepage

Cross-site Scripting (XSS) Affecting node-svgo package, versions <3.3.5+ds-1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.44% (36th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN14-NODESVGO-20883282
  • published13 Oct 2026
  • disclosed13 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 13 Aug 2026

CVE-2026-73650  (opens in a new tab)
CWE-79  (opens in a new tab)
CWE-184  (opens in a new tab)

How to fix?

Upgrade Debian:14 node-svgo to version 3.3.5+ds-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream node-svgo package and not the node-svgo package as distributed by Debian. See How to fix? for Debian:14 relevant fixed versions and status.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.