Listen to this Post
SVGO (SVG Optimizer) is a widely used Node.js library and command-line tool for optimizing SVG files. The `removeScripts` plugin (known as `removeScriptElement` in versions 2 and 3) is an opt-in feature designed to strip executable script elements and links from SVG files. However, a security flaw identified as CVE-2026-84370 allows attackers to bypass this plugin’s filters.
The vulnerability stems from two distinct bypass mechanisms. First, the plugin only inspects unprefixed `` elements and fails to recognize namespace-prefixed SVG anchors, such as <svg:a>, when the prefix is bound to the SVG namespace. This allows executable `href` or namespaced `:href` values to persist. Second, the URL scheme validator does not account for embedded ASCII control characters like tabs ( `), line feeds (`), or carriage returns (
\r). Browsers typically strip these characters before parsing a URI scheme, meaning an obfuscated value such as `java script:` can bypass the plugin’s `javascript:` check and remain executable.
Applications that rely on this plugin as their sole protection for untrusted SVG input are vulnerable. If an attacker-controlled SVG is processed and then served in an active browser context, a victim who interacts with the malicious link could execute arbitrary JavaScript in the SVG’s origin. This could lead to session hijacking, data exposure, or unauthorized actions performed on behalf of the victim. The plugin is opt-in, so users who do not enable it are not affected, and local optimization of trusted SVG files remains safe.
DailyCVE Form:
Platform: Node.js / npm
Version: <2.8.4, <3.3.5, <4.1.0
Vulnerability: XSS Bypass
Severity: High (CVSS 8.2)
date: 2026-09-01
Prediction: 2026-09-15
What Undercode Say:
To check if your project is using a vulnerable version of SVGO, run the following command:
npm list svgo
To identify which version of the `removeScripts` or `removeScriptElement` plugin is active, inspect your SVGO configuration file (e.g., `svgo.config.js` or the `plugins` array in your project):
grep -r "removeScripts|removeScriptElement" . --include=".js" --include=".json"
Exploit: (Educational Purposes!)
An attacker can craft an SVG payload that bypasses the `removeScripts` plugin. The following examples illustrate the two bypass techniques:
1. Namespace-Prefixed Anchor Bypass
The plugin fails to recognize SVG anchors with a namespace prefix. An attacker can use `href:
<svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg">
<svg:a href="javascript:alert('XSS')">Click me</svg:a>
</svg>
2. Control-Character Obfuscation in URL Scheme
The plugin’s URL scheme check does not sanitize ASCII control characters. An attacker can embed a tab or newline to bypass the `javascript:` filter:
<svg xmlns="http://www.w3.org/2000/svg">
<a href="java script:alert('XSS')">Click me</a>
</svg>
When the optimized SVG is rendered in a browser, the control characters are stripped, and the `javascript:` scheme is executed.
Protection:
To protect against CVE-2026-84370, take the following actions:
- Upgrade SVGO Immediately: Update to the patched versions for your release line:
– For v2 users: upgrade to `2.8.4`
– For v3 users: upgrade to `3.3.5`
– For v4 users: upgrade to `4.1.0`
npm install svgo@<version>
2. Use a Dedicated Sanitizer: For hostile or untrusted SVG input, do not rely solely on removeScripts. Implement a dedicated SVG sanitization library, such as DOMPurify, as a preprocessing step before passing the SVG to SVGO.
3. Isolate Untrusted Content: Serve user-controlled SVG files in a sandboxed, cross-origin context. Use a dedicated domain, subdomain, or Content-Security-Policy (CSP) headers to minimize the impact of a potential XSS.
Impact:
Successful exploitation of this vulnerability can have severe consequences:
– Session Hijacking: An attacker can steal cookies or local storage, gaining unauthorized access to user sessions.
– Data Exfiltration: Sensitive data displayed within the SVG’s origin can be accessed and exfiltrated.
– Unauthorized Actions: The attacker can perform actions on behalf of the victim, such as modifying content, making transactions, or changing account settings.
– DOM Manipulation: The attacker can manipulate the Document Object Model (DOM) of the affected application, potentially leading to further attacks like phishing or UI redressing.
The risk is particularly high for applications that serve user-uploaded SVGs in a same-origin context.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
