Detections
Analytics
SCA: security update for svgo (GHSA-w27v-7q3p-w38r)
high Tenable Cloud Security Plugin ID 477513
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named
removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js
and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a
with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return
characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing
an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input
and serves the result in an active browser context, a victim who activates the surviving link can execute
script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is
fixed in versions 2.8.4, 3.3.5, and 4.1.0. (CVE-2026-84370)
Solution
Update the svgo library and its related packages to version 2.8.4 or later.See Also
Plugin Details
Severity: High
ID: 477513
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/27/2026
Updated: 10/27/2026
Risk Information
VPR
Risk Factor: Low
Score: 3.9
Percentile: 52.48
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N
CVSS Score Source: CVE-2026-84370
CVSS v3
Risk Factor: High
Base Score: 8.2
Temporal Score: 7.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/8/2026
Vulnerability Publication Date: 9/1/2026
Reference Information
CVE: CVE-2026-84370