7.5
High
CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files
Description
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Advanced Cluster Security for Kubernetes 4.8 1775594119 | earliest → < 1775594119 | 1775594119 |
| Red Hat Ansible Automation Platform 2.5 1777403872 | earliest → < 1777403872 | 1777403872 |
| Red Hat Ansible Automation Platform 2.6 1774243862 | earliest → < 1774243862 | 1774243862 |
| Red Hat Developer Hub 1.8 1776784286 | earliest → < 1776784286 | 1776784286 |
| Red Hat Developer Hub 1.9 1777903262 | earliest → < 1777903262 | 1777903262 |
| Red Hat OpenShift AI 2.16 1774282136 | earliest → < 1774282136 | 1774282136 |
Show the 45 other branches Hide the 45 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift AI 2.25 1780467147 | earliest → < 1780467147 | 1780467147 |
| Red Hat OpenShift AI 3.3 1778666987 | earliest → < 1778666987 | 1778666987 |
| Red Hat OpenShift Dev Spaces 3.28 1779814592 | earliest → < 1779814592 | 1779814592 |
| Red Hat OpenShift Service Mesh 2.6 1776191302 | earliest → < 1776191302 | 1776191302 |
| Red Hat OpenShift Service Mesh 3.0 1776151272 | earliest → < 1776151272 | 1776151272 |
| Red Hat OpenShift Service Mesh 3.1 1776151270 | earliest → < 1776151270 | 1776151270 |
| Red Hat OpenShift Service Mesh 3.2 1776149682 | earliest → < 1776149682 | 1776149682 |
| Red Hat OpenShift Service Mesh 3.3 1776151277 | earliest → < 1776151277 | 1776151277 |
| Red Hat Quay 3.12 1776752646 | earliest → < 1776752646 | 1776752646 |
| Red Hat Quay 3.14 1779689392 | earliest → < 1779689392 | 1779689392 |
| Red Hat Quay 3.15 1775169219 | earliest → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.17 1779922205 | earliest → < 1779922205 | 1779922205 |
| Red Hat Quay 3.1 1776736910 | earliest → < 1776736910 | 1776736910 |
| Red Hat Quay 3.9 1775169218 | earliest → < 1775169218 | 1775169218 |
| Cryostat 4 | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift distributed tracing 3 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat build of OptaPlanner 8 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| svgo | 4.0.0 | No fix stated |
| svgo 3.0 | 3.0.0 → < 3.3.3 | 3.3.3 |
| svgo 2.1 | 2.1.0 → < 2.8.1 | 2.8.1 |
| Red Hat Quay 3.10 1776736910 | earliest → < 1776736910 | 1776736910 |
| Red Hat OpenShift Service Mesh 3 1776151272 | earliest → < 1776151272 | 1776151272 |
| Red Hat Advanced Cluster Security 4.8 1775594119 | earliest → < 1775594119 | 1775594119 |
| Red Hat Quay 3.18 1784987273 | earliest → < 1784987273 | 1784987273 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8
The 100 CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8 →
CVE-2026-84724
Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
6.6
Medium
CVE-2026-84720
Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle
6.5
Medium
CVE-2026-84718
Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
4.3
Medium
CVE-2026-84717
Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates
5.3
Medium