Scalable Vector Grief
Summary: PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizers and bypassed six of them, including mattkrick/sanitize-svg, Borewit/svg-sanitizer, bgalek/safe-svg, alnorris/SVG-Sanitizer, cloudflare/svg-hush and jams2/py-svg-hush. The bypasses included switching an element's XML namespace to XHTML to render HTML inside SVG, animating a link's href into a JavaScript URL, and using a Link response header to load a base64-encoded XSLT stylesheet that executes JavaScript in Firefox even when the response body is harmless XML.
What you should know: Only DOMPurify and darylldoyle/svg-sanitizer held up against everything in the post, so any application accepting SVG uploads and relying on one of the other six libraries is exposed to script execution in the document's origin. Heyes also exploited two popular applications he could not yet name.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026