Researcher bypasses six of eight popular SVG sanitizers
Original title: Scalable Vector Grief
Namespace tricks, animated JavaScript URLs and XSLT data URLs execute script, including via a Firefox response header.
A PortSwigger post says the author tested eight popular SVG sanitizers and bypassed six. Named bypasses hit mattkrick/sanitize-svg, Borewit/svg-sanitizer, bgalek/safe-svg and alnorris/SVG-Sanitizer using XHTML namespaces, foreignObject, animate tags and self-contained XSLT stylesheets. The author also shows Firefox running XSLT from a Link response header when the body is harmless XML, and a Safari GIF-as-SVG import path. The XSLT feature is described as deprecated and due for removal in November 2026.
Unconfirmed: The excerpt names only some of the six bypassed libraries and does not state which of the eight held.
- A namespace switch lets a frame or iframe run a JavaScript URL inside SVG.
- Borewit/svg-sanitizer allowed animate tags to set a JavaScript href.
- An xml-stylesheet data URL can emit a script in the document origin.
- Firefox Link headers can load the same XSLT technique, the author says.
Impact: Stored or response-header cross-site scripting in the document origin
| Product | Affected |
|---|---|
| mattkrick sanitize-svg | — |
| Borewit svg-sanitizer | — |
| bgalek safe-svg | — |
| alnorris SVG-Sanitizer | — |
- ATT&CK
- T1059.007 JavaScript
- Organizations
- PortSwigger
From the original article
4 min read at portswigger.net
I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML. I'll also show you how to get Safari to import a GIF as SVG and execute JavaScript from it.
By portswigger.net via buherator · portswigger.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.