diff --git a/.trivyignore b/.trivyignore
index d24b50e..6f0f8fd 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -51,3 +51,15 @@ CVE-2026-67213 exp:2026-11-11
 # path
 # See: UID2-7659
 GHSA-5p4m-2wfm-xmqj exp:2026-11-11
+
+# CVE-2026-73650 — svgo (HIGH).
+# Not exploitable here: svgo appears only in the two scanned react-client-side lockfiles
+# (javascript-sdk & google-secure-signals): svgo@3.3.3 (@svgr/plugin-svgo dep), postcss-svgo's
+# svgo@2.8.1, and svgo@1.3.2 bundled in react-scripts@5/@svgr/webpack@5.5.0. No src/ file
+# imports svgo or calls optimize() (grep in both src trees returned nothing). Dockerfile runs
+# `npm run build` (CRA) then `npm start` -> server.js is plain express serving the static
+# build; svgo runs only at CRA build time on the app's own trusted SVG assets, never against
+# untrusted request input. removeScripts/removeScriptElement plugin is disabled by default and
+# not configured.
+# See: UID2-7707
+CVE-2026-73650 exp:2026-11-18