SVG without <script> would do just fine. | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		lambdaone 72 days ago \| parent \| context \| favorite \| on: We pwned X, Vercel, Cursor, and Discord through a ... SVG without <script> would do just fine.

naasking 71 days ago [–]

SVG also supports event attributes, so you should probably strip those too.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact