The removeScripts plugin in SVGO removes <script> elements from SVG files, but it does not sanitize executable HTML content inside <foreignObject> elements. This allows an attacker to embed event‑handler attributes (e.g., onload, onbeforetoggle), srcdoc content, or malicious URLs in attributes like action, data, formaction, href, and src. When a host application uses this plugin as the sole protection and serves the optimized SVG in a browser, the embedded script can execute in the viewer’s origin, enabling data exfiltration, DOM manipulation, or other malicious actions.

Affected products are SVGO versions prior to 2.8.4, 3.3.5, and 4.1.0. Vulnerable releases include SVGO v1.x and any v2.x, v3.x, or v4.x earlier than those fixed tags. The vulnerability exists in the removeScripts plugin (named removeScriptElement in older releases) found in plugins/removeScripts.js. Updating to SVGO v2.8.4, v3.3.5, v4.1.0 or later resolves the sanitization gap.

The CVSS score of 6.1 indicates moderate severity. Since EPSS data is not available and the vulnerability is not listed in CISA KEV, the current exploit probability appears low, yet it can lead to remote code execution when the SVG is rendered in a browser context. Attackers need only supply a crafted SVG file that the application processes with the vulnerable plugin; no authentication or additional privileges are required. Given the potential impact on confidentiality, integrity, and availability, remediation should be treated promptly.