How severe is CVE-2026-84370?

CVE-2026-84370 has a CVSS score of 8.2/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2026-84370?

CVE-2026-84370 affects the following packages: svgo (npm), svgo (npm), svgo (npm). Ecosystems affected: npm.

How do I fix CVE-2026-84370?

Update svgo to 2.8.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-84370 is resolved across your whole dependency graph.

How do I detect CVE-2026-84370 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svgo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-84370 if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is CVE-2026-84370 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-84370 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-84370?

CVE-2026-84370 has an EPSS (Exploit Prediction Scoring System) score of 0.5%, placing it in the 43th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-84370?

CVE-2026-84370 is classified as Cross-site Scripting (XSS) (CWE-79), CWE-184 (CWE-184). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2026-84370 published, and has it been updated?

CVE-2026-84370 was published on September 1, 2026 and was last updated on October 7, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦

📦 npm

Not in CISA KEV

HIGH severity

CVE-2026-84370 — svgo

HIGHFix: svg/svgo@0557385

CVE-2026-84370 is a high-severity (CVSS 8.2) Cross-site Scripting (XSS) vulnerability in svgo. A fix is available for svgo — see the affected versions and patch details below.

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Also known asGHSA-w27v-7q3p-w38r

Published

Sep 1, 2026

Updated

Oct 7, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Exploitation data as of Oct 17, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-84370.

EPSS Exploitation Probability

via FIRST.org ↗

0.5%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs43th percentile — riskier than 43% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-84370 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 390,400 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

3 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

2Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream

svgonpm

22.4Mdownloads / week

Description

Summary

SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).

SVGO is an optimizer rather than a comprehensive sanitization library, but removeScripts is maintained for consumers that already rely on it to remove common script execution paths.

Details

Two related bypasses were present:

The plugin inspected unprefixed SVG <a> elements but did not recognize namespace-prefixed SVG anchors such as <svg:a> when the prefix was bound to the SVG namespace. Their executable href or namespaced *:href values remained intact.
The URL check did not account for ASCII tab, line-feed, or carriage-return characters embedded in a scheme. Browsers remove these characters before parsing the scheme, so values such as java	script: could remain executable after bypassing the plugin's javascript: check.

Anchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.

Impact

If an application optimized attacker-controlled SVGs with removeScripts and then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.

The plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.

Patches

Upgrade to one of the following releases for the maintained release line in use:

Release line	Patched version	Plugin
v2	2.8.4	`removeScriptElement`
v3	3.3.5	`removeScriptElement`
v4	4.1.0	`removeScripts`

The fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.

SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.

Workarounds

For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.

References

v4 fix: https://github.com/svg/svgo/pull/2268
related executable URL hardening: https://github.com/svg/svgo/pull/2263
v3 backport: https://github.com/svg/svgo/pull/2269
v2 backport: https://github.com/svg/svgo/pull/2272
v4.1.0 release: https://github.com/svg/svgo/releases/tag/v4.1.0
v3.3.5 release: https://github.com/svg/svgo/releases/tag/v3.3.5
v2.8.4 release: https://github.com/svg/svgo/releases/tag/v2.8.4

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`svgo`	≥ 1.0.0&&< 2.8.4	2.8.4`npm install svgo@2.8.4`
📦npm	`svgo`	≥ 3.0.0&&< 3.3.5	3.3.5`npm install svgo@3.3.5`
📦npm	`svgo`	≥ 4.0.0&&< 4.1.0	4.1.0`npm install svgo@4.1.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svgo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update svgo to 2.8.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-84370 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

A flaw was found in SVGO's removeScripts plugin (opt-in), which is designed to filter executable links from SVG files. The plugin incompletely handles namespace-prefixed SVG anchor elements (e.g., svg:a) and fails to remove ASCII control characters (tab, line-feed, carriage-return) before validating URL schemes. When…

Workaround published by Red Hat

Do not use SVGO's removeScripts plugin as the sole protection mechanism for untrusted SVG input. If processing untrusted SVG files, use a comprehensive SVG sanitization library designed for security purposes, or avoid serving processed SVGs in active browser contexts. For applications currently using the removeScripts plugin, upgrade SVGO to version 2.8.4, 3.3.5, or 4.1.0 (or later) as appropriate for your version series.

Source: Red Hat security advisory for CVE-2026-84370 (CC BY 4.0)

Frequently Asked Questions

## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS). SVGO is an optimizer rather than a comprehensive sanitization library, but `removeScripts` is maintained for consumers that already rely on it to remove common script execution paths. ## Details Two related bypasses were present: 1. The plugin inspected unprefixed SV