Is SVG upload an XSS risk?

Reference page — draft, pending review

Short answer

Yes. SVG is an XML-based format that can contain embedded <script> tags and event-handler attributes — treating an SVG upload as "just an image" is a common and dangerous assumption.

What makes SVG different from other image formats

Unlike a raster format like PNG or JPEG, SVG is text-based XML that browsers can execute script within, if the SVG is rendered inline (via <img> it's usually inert, but via <object>, <iframe>, direct navigation, or inline embedding it can execute). A malicious SVG file uploaded as a "profile picture" can carry a working XSS payload if the app ever serves or embeds it in a context that executes script.

Doing it safely

✓Sanitize uploaded SVGs (strip script tags and event handlers) with a dedicated library before storing or serving them
✓Serve user-uploaded images from a separate cookieless domain/subdomain, so even a successful script execution can't access the main site's session
✓Set a Content-Disposition: attachment header or serve via <img> only (never <object>/<iframe>) for untrusted SVGs
✓Consider converting uploaded SVGs to a raster format server-side, which eliminates the script-execution surface entirely

FAQ

Does validating the file extension or MIME type solve this?

No — a file can have a valid .svg extension and correct MIME type while still containing an embedded script; content validation/sanitization is required, not just type checking.

Is SVG upload an XSS risk?

What makes SVG different from other image formats

Doing it safely

FAQ

References