You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory.
Details
The upstream XML parser (sax) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the DOCTYPE, inserting them into parser.ENTITIES, and enabled unparsedEntities. This gives us the desired behavior of supporting SVGs with entities declared in the DOCTYPE.
However, entities can reference other entities, which can enable small SVGs to explode exponentially when we try to parse them.
Proof of Concept
import{optimize}from'svgo';/** Presume that this string was obtained in some other way, such as network. */constoriginal=` <?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz>`;optimize(original);
Impact
If SVGO is run on untrusted input (i.e., user uploaded to server-side application), then the untrusted SVG can effectively stall or crash the application with an SVG < 1 KB in size.
It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.
Patches
SVGO has patched v4.0.1, v3.3.3, and v2.8.1! However, it's strongly recommended to upgrade to v4 regardless, as previous versions are not officially supported anymore.
Workarounds
== 4.0.0
For v4, users do not specifically have to upgrade SVGO, though it is recommended to do so. A package manager can be used to upgrade sax recursively:
For example:
yarn up -R sax
New options were introduced upstream which makes the way SVGO parses SVGs safe by default.
>= 2.1.0, <= 3.3.2
Users of v3 and v2 will have to take manual action. If users can't upgrade, they may be able to work around this as long as the project doesn't require support for custom XML entities, though it's not a simple flag.
Parse the DOCTYPE directly and check for the presence of custom entities. If entities are present, throw/escape before passing them to SVGO.
This release left *.test.js files in the package, which have been omitted in v2.8.2. Sorry for the noise!
What's Changed
Dependencies
Migrates from our unsupported fork of sax (@trysound/sax) to the upstream version of sax (sax).
Bug Fixes
No longer throws error when encountering comments in DTD.
Metrics
Before and after of the browser bundle of each respective version:
v2.8.0
v2.8.1
Delta
svgo.browser.js
587.2 kB
589.2 kB
⬆️ 2 kB
Support
SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.
To fix this I made docs more concrete about plugin (5165ccb)
and introduced a warning when true is specified in overrides (cb7e9be).
Please give us feedback if you still have issues.
This release adds support for es modules in svgo.config.js when package.json type field is "module".
For projects with mixed cjs and esm svgo.config.mjs and svgo.config.cjs are also supported as fallback.
Before people struggled to figure out what and why happens with such cryptic error
Error: Error in parsing SVG: Unquoted attribute value
Line: 1
Column: 29
Char: 6
File: input.svg
This gives too little information when a lot of svgs are transformed.
New errors look like this, include context and point to exact location with the issue.
We hope this will solve many issues when dealing with bundlers and other tools integrations.
To get better compression results SVGO uses multipass option. This option is used
to run prefixIds plugin only once to prefix ids and classes properly.
Though sometimes users run svgo manually a few times which leads to duplicated
prefixes and make code much bigger. To solves this prefixIds was redesigned
to add prefix only when it does not exit in ids and classes.
Eventually all plugins are planned to be determenistic and idempotent
so multipass option would not be necessary and single pass compression
could be as effective as possible.
In this release I happy to introduce the new plugin "preset-default" which allows to declaratively setup and customize default set of plugins. Previous solution extendDefaultPlugins utility prevented parcel users from using cachable json config, svgo-loader and svgo-jsx required svgo to be installed locally. "preset-default" plugin is just another builtin plugi.
Internal AST is migrated to XAST. This spec makes maintaining plugins easier and may be used as interop with other tools like SVGR.
The new visitor plugin type combines features of "full", "perItem" and "perItemReverse" plugins without loosing simplicity. Eventually only visitor api will be supported. See #1454
Also small fixes
override default floatPrecision in plugins with globally specified one (7389bcd)
Wow, two minor releases in a row. There is a big reason for that. We got a new logo! See it in readme. Big thanks to @DerianAndre.
There were also implemented brand new path data parser and stringifier (#1378 and #1387) to do more reliable transformations and produce smaller svg.
A cup of small fixes
fixed optimisation when stroke-linecap=round is specified (7901588)
prevented transform applying when inline style is present (79dbb4b)
apply transform to stroke-dasharray and stroke-dashoffset (dd37fcf)
fixed removing hidden elements when descendant enables visibility (d06747a)
fixed removing elements with zero opacity inside clipPath (9d67586)
fixed removing empty mask which can hide elements by id (d14315b)
fixed removing stroke-width when marker-end is specified (3639156)
Happy to introduce SVGO 2.0. Package size was drastically reduced. Configuration
is heavily simplified. Node 10.13+ is required.
smaller install size
simplified config format
added browser ready es module bundle
API is synchronous
support only svgo.config.js for external configuration
Config changes
Since early versions plugins configuration was affected by yaml syntax.
Though it was not practial in json or javascript for writing and for internal
work.
In v1 full flag allowed to disable all default plugins and run only specified
in plugins list. In v2 it's default behaviour. To extend default plugins list
you can use extendDefaultPlugins utility.
Painful coa was replaced with well maintained commander.
--enable and --disable flags are removed. In later versions we will explore
plugins setup via CLI.
Inlined json config is no longer suppored. CLI flags should be used instead.
--config="{multipass:true}"
By default SVGO CLI will search for svgo.config.js. --config flag allows
to specify js config with any name.
YAML and JSON configuration is no longer supported for the sake of simplicity
and less dependencies.
Node API changes
Initially SVGO was implemented with callback style api to fit sax recommendation.
Though in practice api was synchronous and allowed to access the result assigned
in callback right after optimisation.
For v1 callback style was replaced with promise api which cannot longer be run
synchronously. This was a pain point for many tools and required hacking svgo.
In v2 this pain is considered and api is now synchronous. No hacks necessary.
There were a lot of request for this feature in the past.
Now tools like svgomg may use official and tested es module for browsers with optimize, extendDefaultPlugins and createContentItem support.
renovatebot
changed the title
chore(deps): update dependency svgo to v2 [security]
chore(deps): update dependency svgo to v2 [security] - autoclosed
Mar 27, 2026
renovatebot
changed the title
chore(deps): update dependency svgo to v2 [security] - autoclosed
chore(deps): update dependency svgo to v2 [security]
Mar 30, 2026
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
renovate
bot
changed the title
This PR contains the following updates:
^1.3.2→^2.0.0GitHub Vulnerability Alerts
CVE-2026-29074
Summary
SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with
JavaScript heap out of memory.Details
The upstream XML parser (sax) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the
DOCTYPE, inserting them intoparser.ENTITIES, and enabledunparsedEntities. This gives us the desired behavior of supporting SVGs with entities declared in theDOCTYPE.However, entities can reference other entities, which can enable small SVGs to explode exponentially when we try to parse them.
Proof of Concept
Impact
If SVGO is run on untrusted input (i.e., user uploaded to server-side application), then the untrusted SVG can effectively stall or crash the application with an SVG < 1 KB in size.
It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.
Patches
SVGO has patched v4.0.1, v3.3.3, and v2.8.1! However, it's strongly recommended to upgrade to v4 regardless, as previous versions are not officially supported anymore.
Workarounds
== 4.0.0
For v4, users do not specifically have to upgrade SVGO, though it is recommended to do so. A package manager can be used to upgrade sax recursively:
For example:
New options were introduced upstream which makes the way SVGO parses SVGs safe by default.
>= 2.1.0, <= 3.3.2
Users of v3 and v2 will have to take manual action. If users can't upgrade, they may be able to work around this as long as the project doesn't require support for custom XML entities, though it's not a simple flag.
Parse the DOCTYPE directly and check for the presence of custom entities. If entities are present, throw/escape before passing them to SVGO.
Resources
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HRelease Notes
svg/svgo (svgo)
v2.8.1Compare Source
Deprecated
This release left
*.test.jsfiles in the package, which have been omitted in v2.8.2. Sorry for the noise!What's Changed
Dependencies
Bug Fixes
Metrics
Before and after of the browser bundle of each respective version:
Support
SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.
Consider reading our Migration Guide from v2 to v3 and Migration Guide from v3 to v4 which should ease the process.
v2.8.0Compare Source
If you enjoy SVGO and would like to support our work, consider sponsoring us directly via our OpenCollective.
Join us in our discord
Features and bug fixes
xmlns:xlinkattribute (#1508)requireto fix segfaults in linux (#1605)Refactorings
DX
I found some users are trying to enable plugins which are not part of default preset, for example
To fix this I made docs more concrete about plugin (
5165ccb)and introduced a warning when true is specified in overrides (
cb7e9be).Please give us feedback if you still have issues.
Thanks to @IlyaSkriblovsky, @devongovett, @matheus1lva, @omgovich, @renatorib and @TrySound
v2.7.0Compare Source
If you enjoy SVGO and would like to support our work, consider sponsoring us directly via our OpenCollective.
Join us in our discord
ES Modules support
This release adds support for es modules in svgo.config.js when package.json type field is "module".
For projects with mixed cjs and esm svgo.config.mjs and svgo.config.cjs are also supported as fallback.
See #1583
Fixes
Refactorings
Follwing plugins are migrated to the new visitor plugin api and covered with tsdoc
Other internal changes
Thanks to @renatorib, @matheus1lva, @omgovich, @deepsweet, @ai, @samouss and @TrySound
v2.6.1Compare Source
optimize(svg)usage without config (#1573)Thanks to @XhmikosR, @thewilkybarkid, @renatorib, @matheus1lva, @omgovich and @TrySound
v2.6.0Compare Source
If you enjoy SVGO and would like to support our work, consider sponsoring us directly via our OpenCollective.
We have some good stuff in this release
Better syntax errors (#1553)
Before people struggled to figure out what and why happens with such cryptic error
This gives too little information when a lot of svgs are transformed.
New errors look like this, include context and point to exact location with the issue.
We hope this will solve many issues when dealing with bundlers and other tools integrations.
pefixIds plugin is now idempotent (#1561)
To get better compression results SVGO uses multipass option. This option is used
to run prefixIds plugin only once to prefix ids and classes properly.
Though sometimes users run svgo manually a few times which leads to duplicated
prefixes and make code much bigger. To solves this prefixIds was redesigned
to add prefix only when it does not exit in ids and classes.
Eventually all plugins are planned to be determenistic and idempotent
so multipass option would not be necessary and single pass compression
could be as effective as possible.
New js2svg options (#1546)
js2svg.eol: 'lf' | 'crlf'
Allows to customize end of line characters which is usually resolved by os.EOL in node.
finalNewline: boolean
Ensures SVG output has a final newline which is required for some tools like git.
Fixes and refactorings
Follwing plugins are migrated to the new visitor plugin api and covered with tsdoc
Also fixed a few bugs
Thanks to @XhmikosR, @matheus1lva, @deepsweet, @omgovich, @adalinesimonian and @TrySound
v2.5.0Compare Source
In this release we have a couple of fixes
680e143)ac8edba)Visitor api now get parentNode in enter and exit callback
And a lot of plugins are migrated to visitor api and covered them with tsdoc
Thanks to @XhmikosR, @morganney, @oBusk, @matheus1lva and @TrySound
v2.4.0Compare Source
Hey everybody!
In this release I happy to introduce the new plugin "preset-default" which allows to declaratively setup and customize default set of plugins. Previous solution
extendDefaultPluginsutility prevented parcel users from using cachable json config, svgo-loader and svgo-jsx required svgo to be installed locally. "preset-default" plugin is just another builtin plugi.We also fixed a few bugs
9e578b5)Thanks to @TrySound, @ydaniv, @ludofischer, @XhmikosR and @joseprio
v2.3.1Compare Source
Fixed vulnerability in css-select dependency (#1485)
Thanks to @ericcornelissen
v2.3.0Compare Source
Hey, everybody! We have a big release here.
Before:
After:
--excludeflag which uses regexps to exclude some files from--folder. See #1409Internal AST is migrated to XAST. This spec makes maintaining plugins easier and may be used as interop with other tools like SVGR.
The new visitor plugin type combines features of "full", "perItem" and "perItemReverse" plugins without loosing simplicity. Eventually only visitor api will be supported. See #1454
Also small fixes
7389bcd)3d4adb6)2799622)a04b27aand6165743)d89d36e)Thanks to @chambo-e, @strarsis, @XhmikosR, @omgovich and @TrySound
v2.2.2Compare Source
ddbd704)v2.2.1Compare Source
This is a big patch with new style computing (#1399) and landed to master regression tests
A lot of bugs are fixed
d6f972c)<style>type attribute in inlineStyles plugin (#1400)<style>support in removeHiddenElems plugin (#1399)0e02fd9)d58a7e6)<style>support when removing useless path commands (c21fef5)<style>support when combining path commands (ba7e9bd)555a961)de4fd79)21c04e4)<pattern>when at least one argument is present (0e6b0c4)<marker>with display none (d3e3726)a2b0e73)<svg>(28c01cf)435 of 526 regression tests are passing
Thanks to @XhmikosR @sk- and @TrySound
v2.2.0Compare Source
Wow, two minor releases in a row. There is a big reason for that. We got a new logo! See it in readme. Big thanks to @DerianAndre.
There were also implemented brand new path data parser and stringifier (#1378 and #1387) to do more reliable transformations and produce smaller svg.
A cup of small fixes
7901588)79dbb4b)dd37fcf)d06747a)9d67586)d14315b)3639156)<tspan>inside<a>(091172a)Thanks to @sk- @XhmikosR @deepsweet and @TrySound
v2.1.0Compare Source
This release introduced two big changes
See fixed bugs
<svg />with enabled cleanupIDs plugin (9b97e06)--configflag does not exist or json string is specified (a855b40)xml:space="preserve"(776ec1e)9de471a)<g>whenfilterattribute is specified (c1d5f0f)Thanks to @XhmikosR @sk- @chromakode @devongovett and @TrySound
v2.0.3Compare Source
82778c8)<defs>by reusePaths plugin (#1201)ea82cc2)rxorryattributes are not specified (7f4e052)<mask>(4490d62)d9f68d3)<path>by default to support many broken non-browser environments (#1353)c1edce4)Thanks to @ChrisRu @XhmikosR @yisibl @TrySound
v2.0.2Compare Source
Thanks to @XhmikosR and @TrySound
v2.0.1Compare Source
--indentflag in CLI (#1331)Thanks to @sk- @Brooooooklyn @strarsis @AlpayY @TrySound
v2.0.0Compare Source
Happy to introduce SVGO 2.0. Package size was drastically reduced. Configuration
is heavily simplified. Node 10.13+ is required.
Config changes
Since early versions plugins configuration was affected by yaml syntax.
Though it was not practial in json or javascript for writing and for internal
work.
In the new version plugins configuration is closer to internal representation.
In v1
fullflag allowed to disable all default plugins and run only specifiedin plugins list. In v2 it's default behaviour. To extend default plugins list
you can use
extendDefaultPluginsutility.Loading custom plugin by path was removed in favour of manual import or require.
CLI changes
Painful
coawas replaced with well maintainedcommander.--enableand--disableflags are removed. In later versions we will exploreplugins setup via CLI.
Inlined json config is no longer suppored. CLI flags should be used instead.
By default SVGO CLI will search for
svgo.config.js.--configflag allowsto specify js config with any name.
YAML and JSON configuration is no longer supported for the sake of simplicity
and less dependencies.
Node API changes
Initially SVGO was implemented with callback style api to fit sax recommendation.
Though in practice api was synchronous and allowed to access the result assigned
in callback right after optimisation.
For v1 callback style was replaced with promise api which cannot longer be run
synchronously. This was a pain point for many tools and required hacking svgo.
In v2 this pain is considered and api is now synchronous. No hacks necessary.
SVGO class is replaced with
optimizefunction.Some tools require the same logic for resolving svgo config as SVGO CLI.
Browser ready bundle
There were a lot of request for this feature in the past.
Now tools like svgomg may use official and tested es module for browsers with
optimize,extendDefaultPluginsandcreateContentItemsupport.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate using a curated preset maintained by