SVG Sanitiser Bypasses: What the PortSwigger Research Means for Web Application Security

Researchers at PortSwigger have published findings showing that six out of eight widely used SVG sanitiser libraries can be bypassed in ways that allow JavaScript to execute in a user's browser, even when the response body contains nothing visibly malicious. Published on 27 October 2026, the research demonstrates how a response header alone can trigger script execution in Firefox, effectively defeating the sanitisation step that many web applications rely on to handle user-uploaded SVG files safely. The work is a significant finding for any development or security team that has treated SVG sanitisation as a reliable control against cross-site scripting.

Why this matters for UK organisations

SVG uploads are supported across a broad range of web applications, including content management systems, document collaboration platforms, e-commerce sites, and internal business tools. Many organisations implement an SVG sanitiser specifically to mitigate the risk of XSS attacks via uploaded files, and the assumption that the sanitiser is working correctly can lead teams to deprioritise other protective measures. If that assumption is wrong, an attacker who can upload a crafted SVG file may be able to execute JavaScript in the context of another user's authenticated session, potentially enabling session hijacking, credential theft, or further exploitation of the application. The fact that the majority of tested libraries were found to be bypassable suggests this is not an edge case affecting a single obscure tool, but a broader issue across the ecosystem.

What to review

Development and security teams should identify which SVG sanitiser library their applications use and check whether it is among those found to be vulnerable in the PortSwigger research. Where a vulnerable library is in use, teams should look for updated versions or patches and assess the urgency of deployment based on whether SVG uploads are exposed to untrusted users. Beyond the sanitiser itself, it is worth reviewing whether a content security policy is in place and correctly configured to limit the impact of any script injection, and whether SVG upload functionality is included in the scope of regular web application penetration testing. Defence in depth remains the most reliable approach: no single control should be the sole barrier against XSS in a production application.

Source: PortSwigger Research