npmPackage

svgo

4 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 4.1.0 (Aug 24, 2026): no advisory affects it
Newest unaffected release: 4.1.0 (Aug 24, 2026), the latest release
Advisories: 4 · 3 high, 1 medium

Weekly downloads: 51.5M
Dependents: 8,056
Releases: 119 since 0.0.1 (Sep 27, 2012)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-84370
Affects 1.0.0 to 2.8.3 (2.8.4 is outside it); 3.0.0 to 3.3.4 (3.3.5 is outside it); 4.0.0 to 4.0.2 (4.1.0 is outside it)
CVE-2026-84369
Affects 1.0.0 to 2.8.3 (2.8.4 is outside it); 3.0.0 to 3.3.4 (3.3.5 is outside it); 4.0.0 to 4.0.2 (4.1.0 is outside it)
CVE-2026-73650
Affects 1.0.0 to 2.8.2 (2.8.3 is outside it); 3.0.0 to 3.3.3 (3.3.4 is outside it); 4.0.0 to 4.0.1 (4.0.2 is outside it)
CVE-2026-29074
Affects 2.1.0 to 2.8.0 (2.8.1 is outside it); 3.0.0 to 3.3.2 (3.3.3 is outside it); 4.0.0 (4.0.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

CVE-2026-84370High 8.2
SVGO: removeScripts allows executable links through namespace and control-character bypasses
Affected: from 1.0.0, fixed in 2.8.4; from 3.0.0, fixed in 3.3.5; from 4.0.0, fixed in 4.1.0.
Fixed in 2.8.4 (released Aug 24, 2026, 8 days before disclosure), 3.3.5 (released Aug 24, 2026, 8 days before disclosure) and 4.1.0 (released Aug 24, 2026, 8 days before disclosure).
The latest release, 4.1.0, is not affected.
59% of svgo downloads last week were affected versions (34.2M).
CVE-2026-84369Medium 6.1
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
Affected: from 1.0.0, fixed in 2.8.4; from 3.0.0, fixed in 3.3.5; from 4.0.0, fixed in 4.1.0.
Fixed in 2.8.4 (released Aug 24, 2026, 8 days before disclosure), 3.3.5 (released Aug 24, 2026, 8 days before disclosure) and 4.1.0 (released Aug 24, 2026, 8 days before disclosure).
The latest release, 4.1.0, is not affected.
59% of svgo downloads last week were affected versions (34.2M).
CVE-2026-73650High 8.2
SVGO: removeScripts plugin leaves some executable scripts intact
Affected: from 1.0.0, fixed in 2.8.3; from 3.0.0, fixed in 3.3.4; from 4.0.0, fixed in 4.0.2.
Fixed in 2.8.3 (released Jul 11, 2026, 33 days before disclosure), 3.3.4 (released Jul 11, 2026, 33 days before disclosure) and 4.0.2 (released Jul 11, 2026, 33 days before disclosure).
The latest release, 4.1.0, is not affected.
52% of svgo downloads last week were affected versions (30M).
CVE-2026-29074High 7.5
SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
Affected: from 2.1.0, fixed in 2.8.1; from 3.0.0, fixed in 3.3.3; from 4.0.0, fixed in 4.0.1.
Fixed in 2.8.1 (released Mar 4, 2026, 2 days before disclosure), 3.3.3 (released Mar 4, 2026, 2 days before disclosure) and 4.0.1 (released Mar 4, 2026, 2 days before disclosure).
The latest release, 4.1.0, is not affected.
28% of svgo downloads last week were affected versions (15.9M).