RealFeedApp Six out of eight filters are vulnerable
Testing revealed that eight popular SVG sanitizers fail to block JavaScript execution. Vulnerabilities allow injecting scripts via response headers or importing GIFs as executable SVGs.
- Field
- computer security
- What they did
- The researcher found that some SVG sanitization libraries can be bypassed by changing the XML namespace of a single element to XHTML to render HTML, or by tricking Safari into importing a GIF as an SVG.
- Why it matters
- This allows JavaScript to execute in Firefox and Safari browsers even when the image data is harmless XML, creating a security risk for applications that process user-uploaded SVG files.
#svg#security#sanitizer#vulnerability#javascript
