svgo (npm)
⚙️ Node.js tool for optimizing SVG files
Advisories
24
Latest version
4.1.0
Released Aug 24, 2026
License
MIT
OpenSSF Scorecard
6.7 / 10
How to fix
Upgrading to 4.1.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install svgo@4.1.0yarn
yarn add svgo@4.1.0pnpm
pnpm add svgo@4.1.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-w27v-7q3p-w38r SVGO: removeScripts allows executable links through namespace and control-character bypasses |
High EPSS 0.53% |
>= 1.0.0, < 2.8.4 | 2.8.4 |
| GHSA-w27v-7q3p-w38r SVGO: removeScripts allows executable links through namespace and control-character bypasses |
High EPSS 0.53% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-w27v-7q3p-w38r SVGO: removeScripts allows executable links through namespace and control-character bypasses |
High EPSS 0.53% |
>= 3.0.0, < 3.3.5 | 3.3.5 |
| GHSA-w27v-7q3p-w38r SVGO: removeScripts allows executable links through namespace and control-character bypasses |
High EPSS 0.53% |
>= 1.0.0, < 2.8.4 | 2.8.4 |
| GHSA-w27v-7q3p-w38r SVGO: removeScripts allows executable links through namespace and control-character bypasses |
High EPSS 0.53% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-w27v-7q3p-w38r SVGO: removeScripts allows executable links through namespace and control-character bypasses |
High EPSS 0.53% |
>= 3.0.0, < 3.3.5 | 3.3.5 |
| GHSA-4vpr-x523-8j87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements |
Medium EPSS 0.43% |
>= 1.0.0, < 2.8.4 | 2.8.4 |
| GHSA-4vpr-x523-8j87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements |
Medium EPSS 0.43% |
>= 3.0.0, < 3.3.5 | 3.3.5 |
| GHSA-4vpr-x523-8j87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements |
Medium EPSS 0.43% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-4vpr-x523-8j87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements |
Medium EPSS 0.43% |
>= 1.0.0, < 2.8.4 | 2.8.4 |
| GHSA-4vpr-x523-8j87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements |
Medium EPSS 0.43% |
>= 3.0.0, < 3.3.5 | 3.3.5 |
| GHSA-4vpr-x523-8j87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements |
Medium EPSS 0.43% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact |
High EPSS 0.43% |
>= 4.0.0, < 4.0.2 | 4.0.2 |
| GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact |
High EPSS 0.43% |
>= 1.0.0, < 2.8.3 | 2.8.3 |
| GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact |
High EPSS 0.43% |
>= 3.0.0, < 3.3.4 | 3.3.4 |
| GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact |
High EPSS 0.43% |
>= 4.0.0, < 4.0.2 | 4.0.2 |
| GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact |
High EPSS 0.43% |
>= 1.0.0, < 2.8.3 | 2.8.3 |
| GHSA-2p49-hgcm-8545 SVGO removeScripts plugin leaves some executable scripts intact |
High EPSS 0.43% |
>= 3.0.0, < 3.3.4 | 3.3.4 |
| GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
High EPSS 0.70% |
>= 2.1.0, < 2.8.1 | 2.8.1 |
| GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
High EPSS 0.70% |
No fix yet | |
| GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
High EPSS 0.70% |
>= 3.0.0, < 3.3.3 | 3.3.3 |
| GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
High EPSS 0.70% |
>= 2.1.0, < 2.8.1 | 2.8.1 |
| GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
High EPSS 0.70% |
>= 4.0.0, < 4.0.1 | 4.0.1 |
| GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
High EPSS 0.70% |
>= 3.0.0, < 3.3.3 | 3.3.3 |
Source: git://github.com/svg/svgo.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor