SVGO (SVG Optimizer), a Node.js library for optimizing SVG files, contains a vulnerability in its opt-in removeScripts plugin (called removeScriptElement in versions 2 and 3). Affected versions range from 1.0.0 up to but not including 2.8.4, 3.3.5, and 4.1.0. The plugin incompletely filters executable links by failing to recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href attributes. Additionally, it does not strip ASCII tab, line-feed, or carriage-return characters before checking URL schemes, which browsers silently remove before parsing, allowing malicious links to bypass the filter. When attacker-controlled SVG input is processed and served in an active browser context, a victim clicking the surviving link can trigger script execution within the SVG's origin. This could lead to data exposure, content modification, or unauthorized actions performed as the victim. Fixes are available in versions 2.8.4, 3.3.5, and 4.1.0.
