Scalable Vector Grief

This one didn't take much effort. The library let <animate> tags through untouched, so you could animate a link's href into a JavaScript URL:

I bypassed the same library a second way using Kevin Mizu's

trick , which uses <animateTransform> to set a JavaScript URL in Safari:

Libraries affected: bgalek/safe-svg, mattkrick/sanitize-svg, alnorris/SVG-Sanitizer

Now things get more interesting. This is a pretty epic technique: you can get JavaScript execution from an XSLT stylesheet without needing a separate file. I was desperate to blog this one, because unfortunately the feature is deprecated and due for removal November 2026.

The trick is to point an xml-stylesheet processing instruction at a data URL. Base64 is the most elegant way to encode the stylesheet, but URL encoding works too:

Here's the stylesheet that gets base64 encoded:

It matches the root of the document and outputs an HTML page containing a script that alerts document.domain, proving the code runs in the document's origin rather than a null origin. Put it all together and you get this:

In the back of my mind was a trick Paulos Yibelo once told me about: Firefox lets you load external CSS files using a Link response header. I figured out that data URLs work there too, which got me thinking: if it works for CSS, could it work for XSLT too? You're damn right it can.

First, I needed a version of the stylesheet that fits in a URL. This one has two layers. The outer stylesheet is URL encoded into a data URL. Inside it, XSLT's document() function loads a second data URL, URL encoded again, containing an XHTML <img> with an onerror handler. The stylesheet copies that into a <foreignObject>, where it fires.

As a processing instruction, it looks like this:

Here's the payload before encoding. I've left the Hackvertor tags in so you can see where each layer of URL encoding is applied:

You can load and edit the full payload in Hackvertor .

With the stylesheet ready, all that's left is to move it out of the document and into a Link header:

The response body is a completely harmless bit of XML, yet this executes in Firefox!

Libraries affected: cloudflare/svg-hush, jams2/py-svg-hush, bgalek/safe-svg

To end this piece of research, here's another epic behaviour, this time in Safari. Firefox and Safari both let you use the <use> element to reference same-origin files, but Safari goes a step further: it lets you import image files as SVG!