CVE-2026-29074highCWE-776

CVE-2026-29074: fallo de gravedad alta en svgo

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear svgo+ Monitorear node-svgo

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
svg · svgo
CVEs relacionadas — svgo

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-84370HIGHSVGO: removeScripts allows executable links through namespace and control-character bypassesEPSS 0.5%CVE-2026-73650HIGHSVGO: removeScripts plugin leaves some executable scripts intactEPSS 0.4%CVE-2026-84369MEDIUMSVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elementsEPSS 0.4%