Scalable Vector Grief
PortSwigger bypassed six of eight major SVG sanitisers by exploiting a Firefox behaviour where response headers can trigger JavaScript execution even from benign SVG bodies—a widespread stored-XSS risk for file-upload features.
Summary written by editorial AI · Source link below
I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.
Editorial Analysis
Enterprises that accept SVG uploads face a broad stored-XSS risk because most sanitiser libraries fail to account for browser-specific header interactions that re-enable script execution.
Audit your file-upload endpoints for SVG handling, verify your sanitiser against the published bypasses, and enforce strict Content-Disposition and CSP headers on served SVG content.
Most popular SVG sanitisation libraries can be bypassed, creating stored cross-site scripting risk wherever users upload images.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at PortSwigger Research in a new tab.
More from the Research Desk
- Firecracker VM Escape: PwnEscape Part 23d
- A Gingerbread House for LLM Agents: Source-Planned Honeypots That Lure Autonomous Attackers into an Isolated Shadow3d
- LABBA: LLM-Assisted Behavioral Biometric Authentication3d
- A Cyber Range Evaluation of Inductive Autonomous Network Incident Response Agents3d
- KeHoSu: Keyed Homoglyph Substitution for Authenticated Text Provenance over Copy-Paste Channels3d