CVE-2026-73650 SVGO: removeScripts plugin leaves some executable scripts intact
Attackers can inject executable scripts into SVGs processed by SVGO, leading to XSS and data theft when victims view the files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73650?
CVE-2026-73650 is a high-severity cross-site scripting vulnerability in svgo, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.
Which versions are affected by CVE-2026-73650?
6 open source packages ship an affected version, including svgo.
| Package | Affected | Fixed in |
|---|---|---|
svgo npm | From 1.0.0 | 2.8.3 |
svgo npm | From 1.0.0 | 2.8.3 |
svgo npm | From 3.0.0 | 3.3.4 |
svgo npm | From 3.0.0 | 3.3.4 |
svgo npm | From 4.0.0 | 4.0.2 |
svgo npm | From 4.0.0 | 4.0.2 |
How do I fix CVE-2026-73650?
Upgrade svgo to a fixed version for your release line: 2.8.3, 3.3.4 or 4.0.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73650 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73650 exists.
Sources
Also known as CLSA-2026-1784682960, CLSA-2026-1790176195, DEBIAN-CVE-2026-73650, GHSA-2p49-hgcm-8545, ROOT-APP-NPM-CVE-2026-73650, ROOT-APP-NPM-GHSA-2p49-hgcm-8545.