Scalable Vector Grief

By PortSwigger Research1 min readPublished 27 October 2026

https://portswigger.net/research/scalable-vector-grief

External Source means this preview stays on Qubicweb while the full article lives on the publisher site.

I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML....

This is a preview.