fix(deps): update dependency svgo@>=3.0.0 <3.3.3 to >=3.3.4 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
svgo@>=3.0.0 <3.3.3 (source)	[>=3.3.3 → >=3.3.4](https://renovatebot.com/diffs/npm/svgo@>=3.0.0 <3.3.3/3.3.3/3.3.4)

---

SVGO removeScripts plugin leaves some executable scripts intact

GHSA-2p49-hgcm-8545

More information

Details

Summary

SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.

Details

SVGO has a plugin for removing scripts from an SVG, which removes:

• <script> elements
• JavaScript URIs (v4 and v3 only)
• on… event handlers (v4 and v3 only)

While SVGO is not a sanitization library, SVGO continues to maintain the plugin for those already using it for this purpose.

However, there were two problems:

• SVGO did not check namespaced/prefixed script elements, for example if one declared an explicit prefix for the SVG namespace ( <svg:script>) instead of using the default namespace ( <script>), the <svg:script> tag would be left intact.
• SVGO case sensitively matched JavaScript URIs, but it should've been case-insensitive.

Proof of Concept

import { optimize } from 'svgo';

/** Presume that this string was obtained in some other way, such as network. */
const original = `
  <svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" xmlns:uwu="http://www.w3.org/1999/xlink" viewBox="0 0 100 100" version="1.1">
    <a uwu:href="JavaScript:(() =&gt; { alert(document.cookie) })();"><text y="30">uwu</text></a>
    <svg:script>
      alert(document.cookie);
    </svg:script>
  </svg>
`;

optimize(original, {
  plugins: ['removeScripts']
});
// Did not remove <svg:script> or uwu:href="JavaScript:…—still executed by browsers.

Impact

If you run SVGO on untrusted input (e.g., user uploads to a web application) and you depended on removeScripts, then some scripts may still be present. If that SVG was then opened directly by another user on the same domain, it could invoke scripts that could read local storage or cookies.

This may affect you if you have enabled one of the following:

SVGO Version	Plugin Name
v4	removeScripts
v3	removeScriptElement
v2	removeScriptElement
v1	removeScriptElement

It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.

Patches

>= 3.0.0, <= 4.0.1

SVGO patched v4.0.2 and v3.3.4. Just upgrade the dependency using your preferred package manager! For example:

yarn up svgo

##### or if SVGO is a nested dependency
yarn up -R svgo

The proposed fix is to improve our namespace-aware handling to explicitly act on the default namespace, SVG namespace, and XHTML namespace only. This handles all scripts that are executed by browsers, but will leave intact custom prefixes that happen to have an element called <*:script> which clients shouldn't treat as executable.

>= 2.0.0, <= 2.8.2

SVGO patched v2.8.3, however SVGO v2 explicitly only implements and documents that it will remove <script> elements and nothing more. It has the namespace aware handling for tags like <svg:script> or <xhtml:script>, but has not been updated to remove JavaScript URIs or event handlers like >= v3. If this is something you need, please upgrade to v4 or v3, or reach for one of the documented workarounds at the end.

>= 1.0.0, <= 1.3.2

SVGO v1 has been deprecated for a while now and won't be patched. Please upgrade to a more recent version! If something is preventing you from doing so, please reach out! We're happy to expand our migration guides or support you if you're having trouble.

Workarounds

If your motivation for enabling the plugin is SVG sanitization, consider reaching for a dedicated SVG sanitization tool and invoke it before passing the SVG to SVGO.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

• https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545
• https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
• https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
• https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
• https://github.com/svg/svgo/releases/tag/v2.8.3
• https://github.com/svg/svgo/releases/tag/v3.3.4
• https://github.com/svg/svgo/releases/tag/v4.0.2
• https://github.com/advisories/GHSA-2p49-hgcm-8545

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

svg/svgo (svgo@>=3.0.0 <3.3.3)

v3.3.4

Compare Source

What's Changed

Security

• removeScriptElement, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @​SethFalco

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

ERROR: This version of pnpm requires at least Node.js v22.13
The current version of Node.js is v18.20.8
Visit https://r.pnpm.io/comp to see the list of past pnpm versions with respective Node.js version support.

[github-actions]

Thank you for following the naming conventions! 🙏