<img> tag. The script gets executed only if the image is given as source in
<script>. Is there any other way to load the script in the image?
Historically, it has been possible, such as the GIFAR malware case from over a decade ago.
But as of now with modern web browsers, there is no way. It has been patched to prevent polyglot images from being executed at will.
<img> will only read and output the image as an image, regardless of the Content-Type of the page itself (it used to take precedence).
However, you might want to know that it might be possible to do an XML injection using an
svg file. XSS will not be possible as long as you stick to the
<img> tag, but XXE can occur.
IE may be vulnerable if you allow access to the image directly (try the direct URL) and aren't leveraging the "nosniff" headers: "X-Content-Type-Options: nosniff" header
But there are a lot of things you need to worry about if allowing untrusted content to be uploaded. See Does X-Content-Type-Options really prevent content sniffing attacks? for a good summary of the issues with allowing file uploads to your site.
Best practice - if you can, serve user content from a separate domain.