Why SVG is an XML document capable of executing JavaScript, and how to safely sanitize vector uploads using DOMPurify and strict CSP.
SVG is not a raster image—it is an XML dialect. The SVG specification explicitly supports <script> tags and event handlers like onload and onerror.
If a user-uploaded SVG is served with Content-Type: image/svg+xml and viewed directly, the browser executes the script in the origin context of the application.
Never serve user-uploaded SVGs inline without stripping script tags, or force Content-Disposition: attachment.
Security Analyst and Aspiring Security Engineer passionate about digital image forensics, OSINT research, CTF steganography challenges, and client-side application security.
Learn how penetration testers evaluate image upload filters and how application security teams enforce strict re-encoding and sandboxing.
How threat actors hide PHP and ASP command execution stubs inside valid image files and how security teams scan for them.