SVGO: removeScripts plugin leaves some executable scripts intact

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-73650 · CVE overview and exploitation status

EUVD-2026-58193

GHSA-2p49-hgcm-8545

cve-program · CVE-2026-73650

• https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545
• https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
• https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
• https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
• https://github.com/svg/svgo/releases/tag/v2.8.3
• https://github.com/svg/svgo/releases/tag/v3.3.4
• https://github.com/svg/svgo/releases/tag/v4.0.2

euvd · EUVD-2026-58193

• https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545
• https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
• https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
• https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
• https://github.com/svg/svgo/releases/tag/v2.8.3
• https://github.com/svg/svgo/releases/tag/v3.3.4
• https://github.com/svg/svgo/releases/tag/v4.0.2

nvd · CVE-2026-73650

• https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
• https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
• https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
• https://github.com/svg/svgo/releases/tag/v2.8.3
• https://github.com/svg/svgo/releases/tag/v3.3.4
• https://github.com/svg/svgo/releases/tag/v4.0.2
• https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545

osv · GHSA-2p49-hgcm-8545

• https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545
• https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
• https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
• https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
• https://github.com/svg/svgo
• https://github.com/svg/svgo/releases/tag/v2.8.3
• https://github.com/svg/svgo/releases/tag/v3.3.4
• https://github.com/svg/svgo/releases/tag/v4.0.2

No related changes are available here.