Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
svg/svgo
main @ 581fe68
1
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Prototype Pollution: 1 prior fix. Scrutinize any change in this area.
plugins/removeViewBox.js: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
XML External Entity (XXE): The XML parser is vulnerable to entity expansion and recursion attacks (such as Billion Laughs), which can lead to application stalls or crashes when processing crafted XML input. This risk is tracked under CVE-2026-29074.
Prototype Pollution: Improperly scoped variables within plugins can pollute the global scope or prototype chain. In removeViewBox.js, failing to declare the `match` variable locally allowed it to leak, posing a prototype pollution risk.