Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-84370
By Stav Salman |
9 September 2026
CVE-2026-84370 – SVGO removeScripts namespace/control-char bypass allows executable SVG links
SVGO removeScripts (aka removeScriptElement in v2/v3) incompletely filters executable links, letting svg:a/namespaced *:href and URLs padded with ASCII t, n, r bypass scheme checks in plugins/removeScripts.js/lib/svgo/tools.js. If optimized attacker SVG is served to a browser, clicking the link triggers XSS in the SVG origin. Affected: svgo `>=1.0.0 =3.0.0 =4.0.0