Skip to content

chore(deps): update dependency svgo to v3.3.4 [security] - #230

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-svgo-vulnerability
Open

chore(deps): update dependency svgo to v3.3.4 [security]#230
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-svgo-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
svgo (source) 3.0.2 → 3.3.4 age confidence

SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)

CVE-2026-29074 / GHSA-xpqw-6gx7-v673

More information

Details

Summary

SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory.

Details

The upstream XML parser (sax) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the DOCTYPE, inserting them into parser.ENTITIES, and enabled unparsedEntities. This gives us the desired behavior of supporting SVGs with entities declared in the DOCTYPE.

However, entities can reference other entities, which can enable small SVGs to explode exponentially when we try to parse them.

Proof of Concept
import { optimize } from 'svgo';

/** Presume that this string was obtained in some other way, such as network. */
const original = `
  <?xml version="1.0"?>
  <!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ELEMENT lolz (#PCDATA)>
  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
  ]>
  <lolz>&lol9;</lolz>
`;

optimize(original);
Impact

If SVGO is run on untrusted input (i.e., user uploaded to server-side application), then the untrusted SVG can effectively stall or crash the application with an SVG < 1 KB in size.

It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.

Patches

SVGO has patched v4.0.1, v3.3.3, and v2.8.1! However, it's strongly recommended to upgrade to v4 regardless, as previous versions are not officially supported anymore.

Workarounds
== 4.0.0

For v4, users do not specifically have to upgrade SVGO, though it is recommended to do so. A package manager can be used to upgrade sax recursively:

For example:

yarn up -R sax

New options were introduced upstream which makes the way SVGO parses SVGs safe by default.

>= 2.1.0, <= 3.3.2

Users of v3 and v2 will have to take manual action. If users can't upgrade, they may be able to work around this as long as the project doesn't require support for custom XML entities, though it's not a simple flag.

Parse the DOCTYPE directly and check for the presence of custom entities. If entities are present, throw/escape before passing them to SVGO.

+ import SAX from 'sax';
  import { optimize } from 'svgo';

- const original =`
+ let original = `
    <?xml version="1.0"?>
    <!DOCTYPE lolz [
    <!ENTITY lol "lol">
    <!ELEMENT lolz (#PCDATA)>
    <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
    <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
    <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
    <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
    <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
    <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
    <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
    <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
    <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
    ]>
    <lolz>&lol9;</lolz>
  `;

+ const parser = SAX.parser();
+ /** @param {string} doctype */
+ parser.ondoctype = (doctype) => {
+   original = original.replace(doctype, '');
+ }
+ parser.write(original);

  optimize(original);
Resources

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

SVGO removeScripts plugin leaves some executable scripts intact

CVE-2026-73650 / GHSA-2p49-hgcm-8545

More information

Details

Summary

SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.

Details

SVGO has a plugin for removing scripts from an SVG, which removes:

  • <script> elements
  • JavaScript URIs (v4 and v3 only)
  • on… event handlers (v4 and v3 only)

While SVGO is not a sanitization library, SVGO continues to maintain the plugin for those already using it for this purpose.

However, there were two problems:

  • SVGO did not check namespaced/prefixed script elements, for example if one declared an explicit prefix for the SVG namespace ( <svg:script>) instead of using the default namespace ( <script>), the <svg:script> tag would be left intact.
  • SVGO case sensitively matched JavaScript URIs, but it should've been case-insensitive.
Proof of Concept
import { optimize } from 'svgo';

/** Presume that this string was obtained in some other way, such as network. */
const original = `
  <svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" xmlns:uwu="http://www.w3.org/1999/xlink" viewBox="0 0 100 100" version="1.1">
    <a uwu:href="JavaScript:(() =&gt; { alert(document.cookie) })();"><text y="30">uwu</text></a>
    <svg:script>
      alert(document.cookie);
    </svg:script>
  </svg>
`;

optimize(original, {
  plugins: ['removeScripts']
});
// Did not remove <svg:script> or uwu:href="JavaScript:…—still executed by browsers.
Impact

If you run SVGO on untrusted input (e.g., user uploads to a web application) and you depended on removeScripts, then some scripts may still be present. If that SVG was then opened directly by another user on the same domain, it could invoke scripts that could read local storage or cookies.

This may affect you if you have enabled one of the following:

SVGO Version Plugin Name
v4 removeScripts
v3 removeScriptElement
v2 removeScriptElement
v1 removeScriptElement

It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.

Patches
>= 3.0.0, <= 4.0.1

SVGO patched v4.0.2 and v3.3.4. Just upgrade the dependency using your preferred package manager! For example:

yarn up svgo

##### or if SVGO is a nested dependency
yarn up -R svgo

The proposed fix is to improve our namespace-aware handling to explicitly act on the default namespace, SVG namespace, and XHTML namespace only. This handles all scripts that are executed by browsers, but will leave intact custom prefixes that happen to have an element called <*:script> which clients shouldn't treat as executable.

>= 2.0.0, <= 2.8.2

SVGO patched v2.8.3, however SVGO v2 explicitly only implements and documents that it will remove <script> elements and nothing more. It has the namespace aware handling for tags like <svg:script> or <xhtml:script>, but has not been updated to remove JavaScript URIs or event handlers like >= v3. If this is something you need, please upgrade to v4 or v3, or reach for one of the documented workarounds at the end.

>= 1.0.0, <= 1.3.2

SVGO v1 has been deprecated for a while now and won't be patched. Please upgrade to a more recent version! If something is preventing you from doing so, please reach out! We're happy to expand our migration guides or support you if you're having trouble.

Workarounds

If your motivation for enabling the plugin is SVG sanitization, consider reaching for a dedicated SVG sanitization tool and invoke it before passing the SVG to SVGO.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

svg/svgo (svgo)

v3.3.4

Compare Source

What's Changed

Security

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

v3.3.3

Compare Source

What's Changed

Dependencies
  • Migrates from our unsupported fork of sax (@​trysound/sax) to the upstream version of sax (sax).
Bug Fixes
  • No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

v3.3.2 v3.3.3 Delta
svgo.browser.js 910.9 kB 912.9 kB ⬆️ 2 kB

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

v3.3.2

Compare Source

Notice

An update on what happened with v3.3.0 and v3.3.1. While we have retained CJS support, the migration to ESM has changed the acceptable ways to import SVGO, in ways that users depended on before. This effectively made SVGO v3 a breaking change.

Rather than resolve or workaround these differences, we've opted to release SVGO v3.3.2, which is effectively a revert to v3.2.0, and deprecate versions v3.3.0 and v3.3.1. We'll then proceed to work on releasing v4 which will document the breaking changes, and feature further breaking changes that were slated for v4, like disabling removeViewBox by default.

Before the v4.0.0 release, I'll put more focus on testing and use release candidates, just to make the release go smoothly! 👍🏽

Sorry for the headache, and thank you for your patience.

v3.3.1

Compare Source

Notice

SVGO v3.3.0, which was meant to migrate to ESM without breaking CJS support, unfortunately broke CJS projects. There was a mistake with exports, so the loadConfig function wasn't available in the CJS bundle and lead to issues for many users.

Thanks to everyone who raised the issue, and to @​nuintun who submitted a pull request to resolve it so quickly.

I apologize for letting that breaking change through, and will aim to do better. Namely, by adding more tests to cover our exports, and any other public interface in general for each distribution of SVGO, so this doesn't happen again.

SVGO v3.3.1 should resolve the issue for CJS projects, but if you encounter anything else, do let us know by opening an issue on GitHub.

v3.3.0

Compare Source

Deprecated

This release introduced breaking changes, which have been reverted in v3.3.2. The bug fixes will be reintroduced in v4.0.0.

What's Changed

ESM

SVGO is now a dual package, serving for both Common JS and ESM usage. We believe there shouldn't be any problems, especially as SVGO as largely stateless, but feel free to open an issue if you encounter problems with this.

To be explicit, this is not a breaking change, and SVGO should continue to work in Common JS projects!

Thanks to @​jdufresne for doing the bulk of the work.

Default Behavior
  • convertColors, now converts all references to colors excluding references to IDs to lowercase. This can be disabled by setting convertCase to false.
Bug Fixes
SVG Optimization
  • convertColors, introduce parameter to convert colors to common casing (lowercase/uppercase). By @​JayLeininger in #​1692
  • removeDeprecatedAttrs, new plugin that is disabled by default to remove SVG attributes that are deprecated. By @​jdufresne in #​1869

Metrics

Before and after using vectors from various sources, with the default preset of each respective version:

SVG Original v3.2.0 v3.3.0 Delta
Arch Linux Logo 9.529 KiB 4.115 KiB 4.097 KiB ⬇️ 0.018 KiB
Blobs 50.45 KiB 42.623 KiB 42.609 KiB ⬇️ 0.014 KiB
Isometric Madness 869.034 KiB 540.582 KiB 540.073 KiB ⬇️ 0.509 KiB
tldr-pages Banner 2.071 KiB 1.07 KiB 1.07 KiB
Wikipedia Logo 161.551 KiB 111.668 KiB 111.668 KiB

Before and after of the browser bundle of each respective version:

v3.2.0 v3.3.0 Delta
svgo.browser.js 910.9 kB 753.0 kB ⬇️ 157.9 kB

v3.2.0

Compare Source

What's Changed

Bug Fixes
SVG Optimization
Performance

Metrics

Before and after using vectors from various sources, with the default preset of each respective version:

SVG Original v3.1.0 v3.2.0 Delta
Arch Linux Logo 9.529 KiB 4.162 KiB 4.115 KiB ⬇️ 0.047 KiB
Blobs 50.45 KiB 42.949 KiB 42.623 KiB ⬇️ 0.326 KiB
Isometric Madness 869.034 KiB 550.153 KiB 540.582 KiB ⬇️ 9.571 KiB
tldr-pages Banner 2.071 KiB 1.07 KiB 1.07 KiB
Wikipedia Logo 161.551 KiB 116 KiB 111.668 KiB ⬇️ 4.332 KiB

Before and after of the browser bundle of each respective version:

v3.1.0 v3.2.0 Delta
svgo.browser.js 660.9 kB 910.9 kB ⬆️ 250 kB

v3.1.0

Compare Source

What's Changed

Bug Fixes
SVG Optimization

Metrics

Before and after using vectors from various sources, with the default preset of each respective version:

SVG Original v3.0.5 v3.1.0 Delta
Arch Linux Logo 9.529 KiB 4.608 KiB 4.162 KiB ⬇️ 0.446 KiB
Blobs 50.45 KiB 42.949 KiB 42.949 KiB
Isometric Madness 869.034 KiB 550.153 KiB 550.153 KiB
tldr-pages Banner 2.071 KiB 1.07 KiB 1.07 KiB
Wikipedia Logo 161.551 KiB 117.146 KiB 116 KiB ⬇️ 1.146 KiB

Before and after of the browser bundle of each respective version:

v3.0.5 v3.1.0 Delta
svgo.browser.js 657.5 kB 660.9 kB ⬆️ 3.4 kB

v3.0.5

Compare Source

What's Changed

Bug Fixes
Chores

Metrics

Before and after using vectors from various sources, with the default preset of each respective version:

SVG Original v3.0.4 v3.0.5 Delta
Arch Linux Logo 9.529 KiB 4.735 KiB 4.608 KiB ⬇️ 0.127 KiB
Blobs 50.45 KiB 42.949 KiB 42.949 KiB
Isometric Madness 869.034 KiB 550.593 KiB 550.153 KiB ⬇️ 0.44 KiB
tldr-pages Banner 2.071 KiB 1.07 KiB 1.07 KiB
Wikipedia Logo 161.551 KiB 117.152 KiB 117.146 KiB ⬇️ 0.006 KiB

Before and after of the browser bundle of each respective version:

v3.0.4 v3.0.5 Delta
svgo.browser.js 656.9 kB 657.5 kB ⬆️ 0.6 kB

v3.0.4

Compare Source

Includes various bug fixes for existing plugins and a new optimization. Also splits removeXMLNS, which removed XLink, into two separate plugins, removeXMLNS and removeXlink.

What's Changed

Default Behavior
Bug Fixes
SVG Optimization
  • convertPathData, convert to z command if going back to initial position, or drop z if redundant. By @​KTibow in #​1822
  • inlineStyles, when inlining a CSS property that's already declared in a presentation attribute of the node, drop the attribute. By @​SethFalco in #​1829
  • removeXlink, new plugin that removes the XLink (xmlns:xlink) namespace and migrates from XLink attributes to the SVG 2 equivalent. Disabled by default. By @​TrySound and @​SethFalco in #​1535

Metrics

Before and after using vectors from various sources, with the default preset of each respective version:

SVG Original v3.0.3 v3.0.4 Delta
Arch Linux Logo 9.529 KiB 4.738 KiB 4.735 KiB ⬇️ 0.003 KiB
Blobs 50.45 KiB 42.949 KiB 42.949 KiB
Isometric Madness 869.034 KiB 550.699 KiB 550.593 KiB ⬇️ 0.106 KiB
tldr-pages Banner 2.071 KiB 1.07 KiB 1.07 KiB
Wikipedia Logo 161.552 KiB 118.441 KiB 117.152 KiB ⬇️ 1.289 KiB

Before and after of the browser bundle of each respective version:

v3.0.3 v3.0.4 Delta
svgo.browser.js 651.7 kB 656.9 kB ⬆️ 5.2 kB

v3.0.3

Compare Source

Includes various bug fixes and optimizations for existing plugins.

We're also revamped the documentation for the project. You can find it on svgo.dev!
The frontend for svgo.dev is maintained in svg/svgo.dev, contributions are welcome.

What's Changed

Default Behavior
  • removeComments, introduces preservePatterns parameter. Preserves legal comments by default, same as the previous behavior, but can now be overridden. By @​SethFalco in #​1812
  • removeDesc, set the removeAny parameter to false by default for accessibility. By @​SethFalco in #​1806
Bug Fixes
SVG Optimization
Performance
Chores

Metrics

Before and after using vectors from various sources, with the default preset of each respective version:

SVG Original v3.0.2 v3.0.3 Delta
Arch Linux Logo 8.584 KiB 4.748 KiB 4.747 KiB ⬇️ 0.001 KiB
Blobs 50.45 KiB 42.949 KiB 42.949 KiB
Isometric Madness 869.034 KiB 550.829 KiB 550.699 KiB ⬇️ 0.13 KiB
tldr-pages Banner 2.071 KiB 1.07 KiB 1.07 KiB
Wikipedia Logo 161.552 KiB 118.441 KiB 118.441 KiB

Before and after of the browser bundle of each respective version:

v3.0.2 v3.0.3 Delta
svgo.browser.js 643.5 kB 651.7 kB ⬆️ 8.2 kB

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch 2 times, most recently from d5a2712 to f2d4723 Compare September 3, 2026 12:04
@renovate
renovate Bot force-pushed the renovate/npm-svgo-vulnerability branch from f2d4723 to d24d701 Compare September 3, 2026 22:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants