Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?

1 Answer 1


XXE vulnerabilities are all to do with the parser. If the parser that processes the SVG file grabs external entities without verification, then it is vulnerable.

For an example, see this vulnerability in an Apache library.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .