Script inside SVG?
Script inside SVG?
Posted Apr 19, 2025 2:15 UTC (Sat) by notriddle (subscriber, #130608)In reply to: Script inside SVG? by excors
Parent article: Catanzaro: Dangerous arbitrary file read vulnerability in Yelp
As an example, the flamegraph reference implementation generates SVG files with embedded JS. You can see the chart even in non-interactive renderers like librsvg, but in a browser you can click a column to zoom in on it.