NPM · JULY 2026 · EARLY WARNING

SVGO's removeScripts Plugin Potentially Leaves Executable Scripts Intact

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

GHSA-2P49-HGCM-8545Severity: HIGH

An early warning has been issued regarding SVGO's removeScripts plugin, which reportedly leaves some executable scripts intact, potentially leading to XSS vulnerabilities. This issue is under investigation.

What happened

The SVGO removeScripts plugin appears to fail in removing namespaced script elements and case-insensitively matching JavaScript URIs, which could result in executable scripts remaining in the output. This vulnerability is being investigated and is tracked under GHSA-2P49-HGCM-8545.

Affected versions of SVGO include multiple ranges from 1.0.0 to 4.0.2, with fixes available in versions 2.8.3, 3.3.4, and 4.0.2 among others. It is recommended to upgrade to the latest version of svgo and consider additional sanitization methods for SVGs to mitigate potential risks.

For detailed information and the latest updates, consult the primary source at https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545. Professional software engineers should review their use of SVGO and assess their exposure to this potential vulnerability.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If svgo is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats