CVE-2026-29074highCWE-776

CVE-2026-29074: falha de alta gravidade em svgo

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar svgo+ Monitorar node-svgo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.7%
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
svg · svgo
CVEs relacionadas — svgo

No mesmo produto, das mais perigosas para as menos.

CVE-2026-84370HIGHSVGO: removeScripts allows executable links through namespace and control-character bypassesEPSS 0.5%CVE-2026-73650HIGHSVGO: removeScripts plugin leaves some executable scripts intactEPSS 0.4%CVE-2026-84369MEDIUMSVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elementsEPSS 0.4%