[From nobody Sat Oct 3 06:51:05 2026 Received: (at submit) by bugs.debian.org; 2 Oct 2026 15:15:11 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.4 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 24; hammy, 150; neutral, 174; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:37086) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xCeyc-003jFp-2d for submit@bugs.debian.org; Fri, 02 Oct 2026 15:15:11 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=hapxK/eP6BP+Ajqd0lSGU2K9Cd4TnXjpjb6xDwIO2qo=; b=J5+k2ztdKxff/JA1bxR9gBa2gK I3YV0UsJeA0c6nQWTvo9x8Fxki9vz8ou4r0O3DW2o1AJ+BHxLWfUD9vcqeO6qvs62L6d53wSQdwzY 7SYzTWvUYq6LNe0jvO8XP5dJ9VBB8cEqWoXcUX18dfYhXvIEvkjn0S5nqoe2YmXODuC1Ls2OcZNp9 t46nRKFsLSjJ64sTmAHJ9XrkMj0crkbuZO6H0FM9IIwsT/bzij2fuzKnAY+JsN2n0qZ8HoSgRywXJ rb7IiVUvaXinSz/hbD3+Lmkm8ha/3+DHpTSbtMYXe/YXLWXncvWZ+FjCe1t1MIT1SHyEhzlqDQQpe HfA/qIBA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xCeyb-000xID-29 for submit@bugs.debian.org; Fri, 02 Oct 2026 15:15:10 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id 44160DC05AA; Fri, 02 Oct 2026 17:15:09 +0200 (CEST) Date: Fri, 2 Oct 2026 17:15:09 +0200 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: node-svgo: CVE-2026-29074 CVE-2026-73650 CVE-2026-84369 CVE-2026-84370 Message-ID: <ar_KfQo__NZM_Xyf@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: node-svgo Version: 3.3.2+ds-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Hi, The following vulnerabilities were published for node-svgo. CVE-2026-29074[0]: | SVGO, short for SVG Optimizer, is a Node.js library and command-line | application for optimizing SVG files. From version 2.1.0 to before | version 2.8.1, from version 3.0.0 to before version 3.3.3, and | before version 4.0.1, SVGO accepts XML with custom entities, without | guards against entity expansion or recursion. This can result in a | small XML file (811 bytes) stalling the application and even | crashing the Node.js process with JavaScript heap out of memory. | This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1. CVE-2026-73650[1]: | SVGO, short for SVG Optimizer, is a Node.js library and command-line | application for optimizing SVG files. From version 1.0.0 until | versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named | removeScriptElement in versions 1 through 3, can leave executable | content in optimized SVGs because it does not remove namespaced or | prefixed script elements such as <svg:script> and, in versions 3 and | 4, matches JavaScript URIs case sensitively. Applications that | process untrusted SVG input with this plugin enabled and serve the | result can allow scripts to execute when another user opens the SVG, | exposing local storage or cookies. This issue is fixed in versions | 2.8.3, 3.3.4, and 4.0.2. CVE-2026-84369[2]: | SVGO, short for SVG Optimizer, is a Node.js library and command-line | application for optimizing SVG files. From version 1.0.0 until | versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, | named removeScriptElement in versions 2 and 3 and implemented in | plugins/removeScripts.js, removes SVG and XHTML script elements but | does not inspect executable HTML content inside SVG foreignObject | elements. Event-handler attributes such as onload and | onbeforetoggle, srcdoc documents, and executable URLs in the action, | data, formaction, href, and src attributes can remain in attacker- | controlled SVG input. When an application uses the plugin as its | only protection and serves the optimized SVG in an active browser | context, the payload can execute script in the viewer's origin, | expose data, modify content, or perform actions as the victim. This | issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0. CVE-2026-84370[3]: | SVGO, short for SVG Optimizer, is a Node.js library and command-line | application for optimizing SVG files. From version 1.0.0 until | versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, | named removeScriptElement in versions 2 and 3, incompletely filters | executable links in plugins/removeScripts.js and lib/svgo/tools.js. | The plugin does not recognize namespace-prefixed SVG anchor elements | such as svg:a with href or namespaced *:href values, and it does not | remove ASCII tab, line-feed, or carriage-return characters before | checking URL schemes. Browsers remove those characters before | parsing a scheme, allowing an executable link to pass the plugin's | check. When an application processes attacker-controlled SVG input | and serves the result in an active browser context, a victim who | activates the surviving link can execute script in the SVG's origin, | expose data, modify content, or perform actions as the victim. This | issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-29074 https://www.cve.org/CVERecord?id=CVE-2026-29074 [1] https://security-tracker.debian.org/tracker/CVE-2026-73650 https://www.cve.org/CVERecord?id=CVE-2026-73650 [2] https://security-tracker.debian.org/tracker/CVE-2026-84369 https://www.cve.org/CVERecord?id=CVE-2026-84369 [3] https://security-tracker.debian.org/tracker/CVE-2026-84370 https://www.cve.org/CVERecord?id=CVE-2026-84370 Regards, Salvatore ]