Can an SVG file be dangerous?

Yes: an SVG is XML that can contain JavaScript, so opened directly in a browser it behaves like a web page. Browsers disable scripting when SVGs are loaded as images, but that does not make an uploaded SVG safe to open directly.

How a .SVG file can do harm

  • Script elements and event handlers that run when the SVG is opened as a document or inlined into a page
  • Phishing content: a full fake login form drawn in SVG, sent as an 'image' attachment that email filters wave through
  • Links to external resources, which can leak the viewer's IP address or load further content
  • HTML smuggling: script that decodes and offers a download of an executable when the SVG is opened
  • XML external entity references in old or misconfigured parsers

What it cannot do

  • Run script when loaded through an img tag, a CSS background, or most desktop image viewers; browsers disable scripting in those contexts
  • Access files or other sites from the browser beyond what any web page can

Signs of a suspicious .SVG file

  • An .svg attachment in email, particularly one described as an invoice, a voicemail or a document
  • A file that opens as a login page or a 'click here' button rather than a picture
  • A <script> element or onload= attribute visible when the file is opened in a text editor
  • Unexpectedly large size for a simple graphic

Before you open it

  1. Open unknown SVGs in a text editor first; the markup is readable, and script is obvious
  2. Never open an SVG attachment directly in a browser; view it through an image viewer instead
  3. If you accept SVG uploads on a site, sanitise them with an SVG-aware sanitizer such as DOMPurify before publishing; serving them through img tags alone does not protect direct navigation to a same-origin URL
  4. After sanitising, optionally use SVGO to strip metadata and optimise the markup; SVGO is not a security sanitizer

Check that it really is a .SVG file

The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine.

What is a .SVG file?

Related