Researcher bypasses six of eight SVG sanitizers, including via a Firefox response header

PortSwigger researcher Gareth Heyes published findings on 27 October 2026 describing bypasses against six of eight popular SVG sanitizers he tested. SVG files can carry scripts, event handlers and embedded HTML, so applications that accept SVG uploads often pass them through a sanitizer first.

Heyes says the libraries that fell were mattkrick/sanitize-svg, Borewit/svg-sanitizer, bgalek/safe-svg, alnorris/SVG-Sanitizer, cloudflare/svg-hush and jams2/py-svg-hush. He reports that DOMPurify and darylldoyle/svg-sanitizer held up against everything in the post.

The techniques vary by library. One relies on switching an element's XML namespace so the browser renders it as HTML inside the SVG. Another animates a link's href into a JavaScript URL. A third uses a self-contained XSLT stylesheet loaded from a data URL, a feature Heyes notes is deprecated and due for removal in November 2026.

The most unusual finding involves Firefox. Heyes says a Link response header can point at a data URL stylesheet, letting JavaScript run even when the response body is harmless XML. He also describes Safari importing a GIF as SVG through an image element.

Heyes says he also exploited two unnamed applications and will update the post later.

For defenders, the practical point is that sanitizer choice matters and deserves testing against your own upload paths. Heyes's write-up is a summary of bypass classes, not a patch notice, and the source gives no fixed versions.