Remove Scripts & Hidden Code From SVG Files
07 Not a photo format at all - a completely different risk
Every other format on this site is raster pixels wrapped in a binary container. SVG is different: it's
plain XML text describing shapes, and XML can contain a <script> element, inline event
handlers (onload=, onclick=), or XXE entity declarations - real code, not just
data riding along. There's essentially no EXIF/GPS risk here (SVGs aren't camera output), but the active-
content risk is real and specific to this one format.
Go deeper: why SVG can't be "cleaned" the way other formats are
There's no safe subset of arbitrary XML/script to preserve while removing "just the bad parts" - so
this tool doesn't try. Every SVG gets rasterized: rendered to flat pixels through a hardened renderer
(resvg) that never executes <script> content and never makes a network
request while rendering, then that pixel result goes through the same reconstruction pipeline as any
other format. The output is always a PNG - there's no such thing as a "sanitized SVG" here, on
purpose, the same reasoning covered on the comparison page.
What actually gets flagged before rasterizing
The report calls out exactly what was found before it's discarded - <script> elements,
javascript: URIs, inline event-handler attributes, <foreignObject>
elements, and DOCTYPE entity declarations - so you can see specifically what was in the file, not just a
generic "this was cleaned" message.