The removeScripts plugin fails to delete script elements that are namespaced or prefixed, such as <svg:script>, and incorrectly processes JavaScript URIs. As a result, executable scripts may remain in SVG files after optimization. When an attacker crafts such a malicious SVG and an application that enables this plugin optimizes and serves the file, the script runs in the user’s browser, exposing local storage or cookies, which is a cross‑site scripting flaw.

The vulnerability affects all SVGO releases from the initial 1.0.0 through 2.8.3, 3.3.4, and 4.0.2. The problematic code resides in the removeScriptElement (v1‑v3) or removeScripts plugin. Any application that uses SVGO to optimize SVG input—such as web services, static site generators, or image processing pipelines—is at risk unless the user upgrades past the affected releases.

With a CVSS score of 8.2 the flaw is classified as high severity, and it is not yet listed in the CISA KEV catalog. The EPSS score is not available. Based on the description, the most likely attack vector is a remote attacker delivering a crafted SVG to the application for optimization; when another user opens the resulting SVG in a browser, the embedded script executes. Mitigation requires disabling or upgrading the plugin to eliminate the risk.