{"action":"Upgrade svgo to 2.8.4 or later.","affected":[{"fixed":"2.8.4","introduced":"1.0.0"},{"fixed":"3.3.5","introduced":"3.0.0"},{"fixed":"4.1.0","introduced":"4.0.0"}],"component":"svgo","cve_ids":["CVE-2026-84369"],"ecosystem":"npm","epss":0.0043,"exploited":false,"fixed_versions":["2.8.4","3.3.5","4.1.0"],"ghsa_id":"GHSA-4vpr-x523-8j87","id":"tcs_01M5KF1JS0WF8Y9XX7P7HD5ZZS","modified_at":"2026-09-08T21:30:05.558835894Z","published_at":"2026-09-08T21:20:05Z","references":["https://osv.dev/vulnerability/GHSA-4vpr-x523-8j87","https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87","https://nvd.nist.gov/vuln/detail/CVE-2026-84369","https://github.com/svg/svgo/pull/2264","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327","https://github.com/svg/svgo","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-4vpr-x523-8j87","url":"https://osv.dev/vulnerability/GHSA-4vpr-x523-8j87"}],"summary":"SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements"}