Scalable Vector Grief
Summary
PortSwigger's Scalable Vector Grief analyzes weaknesses in SVG sanitizers, showing bypasses that allow JavaScript execution in SVGs in Firefox and Safari. The post tests eight libraries and reveals bypasses via namespace manipulation, animate, XSLT data URLs, and other tricks, with some libraries bypassed and others holding up. It underscores the importance of rigorous sanitization and testing for SVG content in web apps and security tooling.