Menu
Newbedev LogoNEWBEDEV Python Javascript Linux Cheat sheet
Newbedev LogoNEWBEDEV
  • Python 1
  • Javascript
  • Linux
  • Cheat sheet
  • Contact

Is there a way to execute XSS in an HTML img tag with SVG?

No, it's not. Although SVG files can contain JS (see this), these will only get executed if:

  1. the user directly visits the .svg file in their browser
  2. the image is embedded within <embed> tags.

Modern browsers will never execute scripts in SVGs if it's within <img> tags.

And even in the two cases above, the server can provide CSP headers that stop the execution of such scripts.

Tags:

Image

Xss

Svg

Related

What are the differences of checking a self-signed certificate vs ignore it? Is it possible to spoof an IP address to an exact number? Bypass with wrong cvv of debit card and getting OTP What is this Russian calendar reminder that popped up? Isn't "Dave's protocol" good if only the database, and not the code, is leaked? Understanding SQLMAP payload How to securely dispose of a smartphone? What's the safest way to inform a new user of their password on an invite-only website? How can I publish text and video without revealing my identity? Should I use ReCAPTCHA v2 or v3? What's the point of S/MIME? How does Logitech Options software automatically launch from a mouse dongle?

Recent Posts

Pandas how to find column contains a certain value Recommended way to install multiple Python versions on Ubuntu 20.04 Build super fast web scraper with Python x100 than BeautifulSoup How to convert a SQL query result to a Pandas DataFrame in Python How to write a Pandas DataFrame to a .csv file in Python
© 2021 newbedevPrivacy Policy