chore(deps): update devdependency svgo to v4.1.0 [security] - #333
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update devdependency svgo to v4.1.0 [security]#333renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #333 +/- ##
=======================================
Coverage 92.08% 92.08%
=======================================
Files 9 9
Lines 935 935
Branches 317 318 +1
=======================================
Hits 861 861
Misses 65 65
Partials 9 9 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.0.2→4.1.0SVGO: removeScripts allows executable links through namespace and control-character bypasses
CVE-2026-84370 / GHSA-w27v-7q3p-w38r
More information
Details
Summary
SVGO's opt-in
removeScriptsplugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to cross-site scripting (XSS).SVGO is an optimizer rather than a comprehensive sanitization library, but
removeScriptsis maintained for consumers that already rely on it to remove common script execution paths.Details
Two related bypasses were present:
<a>elements but did not recognize namespace-prefixed SVG anchors such as<svg:a>when the prefix was bound to the SVG namespace. Their executablehrefor namespaced*:hrefvalues remained intact.java&#​9;script:could remain executable after bypassing the plugin'sjavascript:check.Anchors in unrelated custom namespaces are not executable SVG anchors and remain untouched.
Impact
If an application optimized attacker-controlled SVGs with
removeScriptsand then served the result in an active browser context, a victim could follow a link that executes script in the SVG's origin. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.The plugin is opt-in, so consumers that do not enable it are not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.
Patches
Upgrade to one of the following releases for the maintained release line in use:
removeScriptElementremoveScriptElementremoveScriptsThe fix makes SVG anchor handling namespace-aware and strips ASCII tabs, line feeds, and carriage returns before checking executable URL schemes.
SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.
Workarounds
For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. Applications can also reject links from untrusted SVG input and avoid serving user-controlled SVGs in an active same-origin context.
References
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
CVE-2026-84369 / GHSA-4vpr-x523-8j87
More information
Details
Summary
SVGO's opt-in
removeScriptsplugin did not inspect executable HTML content inside SVG<foreignObject>elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting (XSS).SVGO is an optimizer rather than a comprehensive sanitization library, but
removeScriptsis maintained for consumers that already rely on it to remove common script execution paths.Details
Although the plugin removed SVG and XHTML
<script>elements, it left other HTML execution paths inside<foreignObject>unchanged. These included:onloadandonbeforetoggle;srcdocdocuments, including on<iframe>elements;action,data,formaction,href, andsrc.An attacker could place one of these payloads in an SVG. If an application optimized the untrusted SVG with
removeScriptsand then served the result in an active browser context, the payload could execute in the viewer's origin.Impact
Successful exploitation could allow script execution in the context where the optimized SVG is rendered. Depending on the embedding and origin configuration, this could expose cookies or local storage, modify content, or perform actions as the victim.
The plugin is opt-in, so consumers that do not enable
removeScriptsare not relying on the affected behavior. Typical local optimization of trusted SVG files is not affected.Patches
Upgrade to one of the following releases for the maintained release line in use:
removeScriptElementremoveScriptElementremoveScriptsThe fix preserves visual HTML inside SVG
<foreignObject>elements while removing event attributes,srcdoc, and executable URL values from active HTML URL attributes.SVGO v1 is no longer maintained. Users of v1 should upgrade to a supported release line.
Workarounds
For hostile input, use a dedicated SVG sanitization tool before passing the SVG to SVGO. As defense in depth, applications can reject or remove
<foreignObject>content and avoid serving user-controlled SVGs in an active same-origin context.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
svg/svgo (svgo)
v4.1.0Compare Source
This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for
removeScripts, dependency updates, and improvements to the test and regression infrastructure.Support SVGO
If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.
Stricter XML validation
SVGO now uses
sax1.6.1, upgraded from 1.5.0 (#2257).The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:
&#​1;,, and;�;.Valid boundary values—including
U+0020,U+D7FF,U+E000,U+FFFD, and characters throughU+10FFFF—remain supported.Parser failures are consistently exposed as
SvgoParserErrorerrors with anInvalid character entityreason.This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.
Security
The
removeScriptsplugin has been hardened against several script-execution bypasses:data:URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacyvbscript:URLs (#2263).<foreignObject>elements by removing HTML event-handler attributes,srcdoc, and executable URLs fromaction,data,formaction,href, andsrc, while preserving non-executable HTML and visual content (#2264).<a>elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such asjava&#​9;script:from bypassing detection while preserving elements in unrelated custom namespaces (#2268).These changes address:
Dependencies
css-selectto v6 andcss-whatto v7, and updated SVGO's custom selector adapter forcss-selectv6 (#2244).Project maintenance
@TrySound is back as an active SVGO maintainer.
Many thanks to @KTibow, @SethFalco, and @XhmikosR for maintaining and improving SVGO over the past several years.
Full Changelog: svg/svgo@v4.0.2...v4.1.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.