Incomplete HTML Sanitization via foreignObject in SVGO's removeScripts Plugin

Alopsis — 2026-09-01

1. Summary SVGO, a widely used Node.js tool for optimizing SVG files, was found to contain a Cross-Site Scripting (XSS) vulnerability (CVE-2026-84369) in its optional removeScripts plugin, which failed to inspect executable HTML content embedded inside SVG elements. As a result, applications that relied solely on this plugin to process untrusted SVG input could generate SVG files containing active HTML, potentially exposing users to XSS attacks. Although SVGO was designed as an optimization tool rather than a full-fledged sanitization library, removeScripts was maintained to remove the most…