« Volver al listado

CVE-2026-84369

Estado: AplazadaMedia (6.1)—

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements.

Leer descripción completaMostrar menos

Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Svgo — SvgoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-84369",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84369",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-02T15:46:08.313290Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "svg",
          "product": "svgo",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.0.0, < 2.8.4"
            },
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.3.5"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-01T21:18:48.037",
  "references": [
    {
      "url": "https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/pull/2264",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/pull/2269",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/pull/2272",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/releases/tag/v2.8.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/releases/tag/v3.3.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/releases/tag/v4.1.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0."
    }
  ],
  "lastModified": "2026-09-09T21:09:13.080",
  "sourceIdentifier": "security-advisories@github.com"
}