CVE-2026-29074
Published: 06 March 2026
Summary
CVE-2026-29074 is a high-severity XML Entity Expansion (CWE-776) vulnerability in Svgo Svgo. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing apps/services processing SVGs via SVGO (T1190) directly triggers application/system DoS through XML entity expansion and resource exhaustion (T1499.004).
NVD Description
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities,…
more
without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
Deeper analysisAI
CVE-2026-29074 is a denial-of-service vulnerability in SVGO, a Node.js library and command-line application for optimizing SVG files. Published on 2026-03-06, it affects versions from 2.1.0 to before 2.8.1, from 3.0.0 to before 3.3.3, and before 4.0.1. The flaw stems from SVGO accepting XML with custom entities without protections against entity expansion or recursion, enabling a small 811-byte XML file to trigger excessive memory usage. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-776.
Any unauthenticated remote attacker can exploit this vulnerability by supplying a malicious SVG file to an application or service using a vulnerable SVGO version. No user interaction or privileges are required, and exploitation is straightforward due to low attack complexity. Successful exploitation stalls the targeted application and can crash the Node.js process via a JavaScript heap out of memory error, resulting in high availability impact without affecting confidentiality or integrity.
The vulnerability has been patched in SVGO versions 2.8.1, 3.3.3, and 4.0.1. Additional details on the issue and remediation are available in the GitHub security advisory at https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673.
Details
- CWE(s)