Download Latest Version v4.1.0 source code.zip (473.0 kB) Google Add to Preferred Sources
Home / v2.8.4
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-08-24 966 Bytes
1 1 weekly downloads
v2.8.4 source code.tar.gz 2026-08-24 1.1 MB
1 1 weekly downloads
v2.8.4 source code.zip 2026-08-24 1.2 MB
1 1 weekly downloads
Totals: 3 Items   2.3 MB 3

What's Changed

Security

  • Backport the removeScriptElement hardening from SVGO v4 in [#2272]:
  • remove known SVG event attributes
  • reject executable data: URLs and legacy vbscript: URLs
  • sanitize executable HTML inside <foreignObject> elements
  • handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v2 release line.

Support

SVGO v2 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guides from v2 to v3 and v3 to v4.

Source: README.md, updated 2026-08-24