Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions svgo could run attacker code
published 9 days ago
Summary
The svgo tool used in GitHub Actions had two security weaknesses that could let an attacker execute malicious code. The problems have been fixed in version 2.8.3-tuxcare.1. Update svgo to this version as soon as possible to protect your workflows.
What to do
- Update GitHub Actions svgo to version 2.8.3-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | svgo |
>= 2.8.3-tuxcare.0, < 2.8.3-tuxcare.1 Fix: upgrade to 2.8.3-tuxcare.1
|
Original advisory text
TuxCare security update for svgo (2 CVEs)
TuxCare rebuilt svgo to address 2 CVEs. Fixed in 2.8.3-tuxcare.1.
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CLSA-2026-1793045772 · OSV
Track software like this
Free during beta