<script>s get executed in inline SVG
<script>s get executed in inline SVG
Posted Apr 16, 2025 23:15 UTC (Wed) by CChittleborough (subscriber, #60775)In reply to: Script inside SVG? by excors
Parent article: Catanzaro: Dangerous arbitrary file read vulnerability in Yelp
I just tried the example from the SVG standard's specification of <script>, and it ran in the latest Firefox and Chrome. So I created a little HTML file containing that SVG, and the JavaScript still runs.
So <img src="example.svg"> is safe, but inline SVG will execute any <script> elements, including event handlers such as onload= attributes.
This is not relevant to the yelp problem, but is something more for long-suffering web developers to keep in mind ...