SVGO: removeScripts allows executable links through namespace and control-character bypasses
npm svgo · Upgrade to 4.1.0, 3.3.5 or 2.8.4 by release line · >= 1.0.0, < 2.8.4; >= 3.0.0, < 3.3.5; >= 4.0.0, < 4.1.0 · CVE-2026-84370 · GHSA-w27v-7q3p-w38r · amended