Tag
PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizers and bypassed six of them, demonstrating XSS via namespace confusion, SMIL animations, response headers in Firefox, and GIF-as-SVG import in Safari.