PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizer libraries and bypassed six of them, revealing critical vulnerabilities in widely-used security tools. The research demonstrates novel attack vectors including namespace confusion to inject HTML into SVGs and unconventional browser behaviors like Firefox executing JS from response headers and Safari importing GIFs as SVG.
Background
SVG sanitization is a critical defense against XSS attacks in applications that allow SVG file uploads. Popular libraries like DOMPurify and svg-sanitizer are widely deployed across web applications but may have incomplete protection.
- Source
- Lobsters
- Published
- Oct 28, 2026 at 03:26 PM
- Score
- 7.0 / 10