There are quite a few ways in which SVGs can contain evil things. iframes, script tags, the use tag (can load external sources), links with javascript, links wi

There are quite a few ways in which SVGs can contain evil things. iframes, script tags, the use tag (can load external sources), links with javascript, links with base 64 encoded javascript, bloody DOM event handlers (on-click etc). At my previous job, user uploadable SVGs were the largest source of vulnerabilities in our product. My unwanted advice: don't let users upload SVGs unless you know what you're doing. We clearly didn't.