CVE-2026-73650
1 advisory.
npm/svgo CVE-2026-73650: high 8.2, EPSS 0.43%
SVGO removeScripts plugin leaves some executable scripts intact
Action: Upgrade svgo to 2.8.3 or later.
npm i svgo@2.8.3npm i svgo@3.3.4npm i svgo@4.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 2.8.3 | - |
| 3.0.0 | 3.3.4 | - |
| 4.0.0 | 4.0.2 | - |
Fixed versions
| 2.8.3 | 3.3.4 | 4.0.2 |
Sources
- osv: GHSA-2p49-hgcm-8545
- https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545
- https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
- https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
- https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
- https://github.com/svg/svgo
- https://github.com/svg/svgo/releases/tag/v2.8.3
- https://github.com/svg/svgo/releases/tag/v3.3.4
- https://github.com/svg/svgo/releases/tag/v4.0.2
CVE-2026-73650 · published · modified · JSON