general
Blog post
Scalable Vector Grief
Source: PortSwigger Research · Published · Last checked 3 hours ago ·

Publisher excerpt From PortSwigger Research
I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.
Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.
Reference: PortSwigger Research — portswigger.net ↗

