CVE-2026-73650 (High) detected in svgo-2.8.2.tgz, svgo-3.3.3.tgz

[mend-bolt-for-github]

CVE-2026-73650 - High Severity Vulnerability

Vulnerable Libraries - svgo-2.8.2.tgz, svgo-3.3.3.tgz

svgo-2.8.2.tgz

Nodejs-based tool for optimizing SVG vector graphics files

Library home page: https://registry.npmjs.org/svgo/-/svgo-2.8.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/rollup-plugin-styles/node_modules/svgo/package.json

Dependency Hierarchy:

• muon-0.0.2-beta.64.tgz (Root Library)
  • rollup-plugin-styles-4.0.0.tgz
    • cssnano-5.1.15.tgz
      • cssnano-preset-default-5.2.14.tgz
        • postcss-svgo-5.1.0.tgz
          • ❌ svgo-2.8.2.tgz (Vulnerable Library)

svgo-3.3.3.tgz

Nodejs-based tool for optimizing SVG vector graphics files

Library home page: https://registry.npmjs.org/svgo/-/svgo-3.3.3.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/svgo/package.json

Dependency Hierarchy:

• muon-0.0.2-beta.64.tgz (Root Library)
  • cssnano-6.1.2.tgz
    • cssnano-preset-default-6.1.2.tgz
      • postcss-svgo-6.0.3.tgz
        • ❌ svgo-3.3.3.tgz (Vulnerable Library)

Found in HEAD commit: f62742a486a7acc9074524b4461667e5e1e3ed9f

Found in base branch: main

Vulnerability Details

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as "svg:script" (svg:script) and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-08-13

URL: CVE-2026-73650

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-13

Fix Resolution: https://github.com/svg/svgo.git - v3.3.4,https://github.com/svg/svgo.git - v4.0.2

---

Step up your Open Source Security Game with Mend here