Bug 2527089 (CVE-2026-84369)

Summary: CVE-2026-84369 svgo: SVGO: Cross-Site Scripting (XSS) vulnerability in SVG foreignObject processing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, akostadi, alizardo, amasferr, amctagga, aoconnor, aschwart, aszczucz, ataylor, bbrownin, bniver, boliveir, brasmith, cdrage, cmah, cochase, csuconic, dbruscin, dmayorov, doconnor, dranck, drichtar, dschmidt, eaguilar, ebaron, flucifre, fmariani, gmalinko, gmeno, groman, gtully, ikhan, janstey, jchui, jhe, jlanda, jlledo, jmatsuok, jsherman, jtolenti, jwong, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, mbenjamin, mcarlett, mhackett, mposolda, nboldt, oaljalju, omaciel, pantinor, pdelbell, pjindal, psrna, rbobbitt, rgemmell, rgodfrey, rhel-process-autobot, rmartinc, rstepani, rushinde, sdawley, sfeifer, simaishi, sostapov, ssilvert, stcannon, sthorger, tbish, tcunning, tlavocat, tsedmik, vereddy, vmuzikar, watson-tool-maintainers, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in SVGO, a tool designed to optimize SVG (Scalable Vector Graphics) files. The `removeScripts` feature, which is meant to remove potentially harmful code, fails to fully sanitize executable HTML content embedded within SVG `foreignObject` elements. This oversight could allow a remote attacker to create a specially crafted SVG file. When this file is processed by SVGO and then viewed in a web browser, it could enable the attacker to run unauthorized scripts, potentially exposing sensitive data or performing actions on behalf of the user.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-01 20:51:22 UTC 
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.