{"action":"Upgrade svgo to 2.8.4 or later.","affected":[{"fixed":"2.8.4","introduced":"1.0.0"},{"fixed":"3.3.5","introduced":"3.0.0"},{"fixed":"4.1.0","introduced":"4.0.0"}],"component":"svgo","cve_ids":["CVE-2026-84370"],"ecosystem":"npm","epss":0.00525,"exploited":false,"fixed_versions":["2.8.4","3.3.5","4.1.0"],"ghsa_id":"GHSA-w27v-7q3p-w38r","id":"tcs_01M5KGDGWAJMM4NNAZPVMEEE2K","modified_at":"2026-09-08T21:30:04.769354630Z","published_at":"2026-09-08T21:20:28Z","references":["https://osv.dev/vulnerability/GHSA-w27v-7q3p-w38r","https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r","https://nvd.nist.gov/vuln/detail/CVE-2026-84370","https://github.com/svg/svgo/pull/2268","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-w27v-7q3p-w38r","url":"https://osv.dev/vulnerability/GHSA-w27v-7q3p-w38r"}],"summary":"SVGO: removeScripts allows executable links through namespace and control-character bypasses"}