SVG Injection Scanner
Detects XSS through SVG file uploads and inline SVG.
What is SVG Injection?
SVG Injection exploits the fact that SVG files are XML documents that can contain JavaScript, external resources, and event handlers. When applications allow SVG uploads or render user-controlled SVG content inline, attackers can achieve XSS, SSRF, or information disclosure through malicious SVG content.
Why is This Important?
SVGs are often treated as safe images but are actually full XML documents with scripting capabilities. Many file upload filters allow SVGs as 'images,' not realizing they can contain <script> tags. Inline SVG rendering directly executes embedded JavaScript in the page context.
How It Works
1. Attack Surface Mapping
Identifies complex attack vectors including race conditions, desync points, and logic flaws in your application.
2. Advanced Exploitation
Executes sophisticated attack techniques that bypass traditional security controls and detection mechanisms.
3. Impact Assessment
Demonstrates real-world impact with detailed exploitation chains and business risk analysis.
Key Capabilities
Expert-level security testing for sophisticated vulnerabilities that evade traditional scanning tools.
- Race condition and timing attack detection
- Request smuggling and desync analysis
- Business logic flaw identification
- Chained exploit development
- Protocol-level vulnerability testing
Frequently Asked Questions
How can SVG achieve XSS?
SVG XSS vectors: <script>alert(1)</script>, <svg onload='alert(1)'>, <foreignObject><script>...</script></foreignObject>, event handlers on any element, CSS expressions (older IE), and external script references. Served as SVG or embedded inline, scripts execute.
What about SVG files served with image Content-Type?
When served as image/svg+xml, modern browsers still execute scripts if the SVG is navigated to directly. When embedded via <img src='evil.svg'>, scripts don't execute in modern browsers. But inline SVG or <object>/<embed> can still execute scripts.
What other attacks are possible with SVG?
Beyond XSS: SSRF via external entity references or <use href='http://internal'>, local file disclosure via XXE if parsed as XML, denial of service through entity expansion, and UI redressing by overlaying invisible elements.
How do I safely handle SVG files?
Safe handling: convert SVGs to raster formats if possible, sanitize SVGs to remove scripts/handlers/external references, serve SVGs with Content-Disposition: attachment, use Content-Security-Policy to block inline scripts, serve from a separate origin, and use SVG sanitization libraries.
Related Scanners
Ready to secure your application?
Start testing for svg injection vulnerabilities today.
Get Started Free