Six of eight popular SVG sanitizers can be bypassed to run JavaScript in browsers
The claim
The authors assert that six out of eight widely used SVG sanitizers can be bypassed to achieve JavaScript execution via crafted SVG payloads.
Published as: “Scalable Vector Grief”
So what
Web applications that rely solely on SVG sanitizers for XSS protection may still be vulnerable to crafted payloads.
The five-minute version
The author evaluated eight popular SVG sanitization libraries and successfully bypassed six of them. Bypasses include switching an element's XML namespace to XHTML, using XSLT stylesheets delivered via a Link response header, and importing a GIF as SVG in Safari. The payloads execute JavaScript in Firefox and Safari despite the response body being harmless XML. The evidence consists of proof-of-concept code and screenshots, but no large-scale deployment data.
What they found 3
- Switching an element's XML namespace to XHTML causes the browser to render HTML and execute JavaScript inside the SVG.
“Switch the XML namespace on a single element to XHTML and the browser renders it as HTML directly inside the SVG.”
- An XSLT stylesheet delivered via a Link response header can execute JavaScript even when the response body is harmless XML.
“The response body is a completely harmless bit of XML, yet this executes in Firefox!”
- Safari allows a GIF image to be imported as an SVG, enabling script execution via the element.
“Safari goes a step further: it lets you import image files as SVG!”
What undercuts it the paper’s own results
- Both DOMPurify and darylldoyle/svg-sanitizer held up against all tested bypasses.
- Two of the eight libraries (the ones not listed as affected) were not bypassed.
Stated limits 3
- The XSLT processing-instruction technique relies on a feature that is deprecated and scheduled for removal in November 2026.
- A true SVG/image polyglot could not be created because SVG is too strict.
- The author could not disclose the two vulnerable applications at the time of writing.
What’s new here 4
- Namespace switch to XHTML inside SVG to render HTML and execute JavaScript.
- Embedding an XSLT stylesheet in a Link header to run script from a data URL.
- Using a GIF file imported as SVG in Safari to trigger JavaScript.
- Demonstrating that some sanitizers (e.g., DOMPurify) resist these techniques while others do not.
Artifacts & methods 8
- mattkrick/sanitize-svgprimitive
- Borewit/svg-sanitizerprimitive
- cloudflare/svg-hushprimitive
- jams2/py-svg-hushprimitive
- bgalek/safe-svgprimitive
- XML namespace injection
- XSLT stylesheet via Link header
- GIF import as SVG in Safari