Scalable Vector Grief portswigger.net

PortSwigger researcher Gareth Heyes reports bypassing six of eight tested SVG sanitizers, including methods using XML namespaces, SVG animation, XSLT and Safari’s handling of GIF files to trigger JavaScript. He also demonstrates that Firefox can execute JavaScript from an XSLT stylesheet supplied in a response `Link` header, despite a harmless XML response body; DOMPurify and darylldoyle/svg-sanitizer resisted the tested techniques.