SVG and Content Security Policy
SVGs can contain embedded scripts — a properly configured CSP prevents that from becoming an XSS vector on your site.
Drop your image here
Supports PNG, JPG, BMP, WEBP up to 5MB
Why SVG Interacts with CSP
Unlike PNG or JPEG, SVG is XML and can embed `<script>` tags or event handler attributes that execute JavaScript — a real concern for any site accepting user-uploaded SVGs. A properly configured Content-Security-Policy blocks these embedded scripts from executing even if a malicious SVG slips through upload validation.
- SVG's XML structure allows embedded executable script content
- This makes user-uploaded SVGs a genuine XSS attack surface
- CSP acts as a defense-in-depth layer beyond upload sanitization
Practical CSP Configuration
For SVGs loaded via `<img>` or `background-image`, scripts inside them never execute regardless of CSP (the browser treats them as pure images in that context) — the real risk is inline `<svg>` markup or `object`/`embed` tags, which do execute scripts. Set `script-src 'self'` and avoid `unsafe-inline` to block injected script execution, and always sanitize SVGs server-side before allowing inline embedding of user content.
- img/background-image SVGs never execute embedded scripts
- Inline <svg> and <object>/<embed> tags do execute scripts — sanitize first
- script-src 'self' without unsafe-inline blocks most injection vectors
Frequently Asked Questions
Is it safe to let users upload SVG files to my site?
Only with server-side sanitization (stripping <script> tags, event handler attributes, and foreignObject elements) before storage, combined with a strict CSP as defense in depth — never trust an uploaded SVG's content by default.
Does displaying SVGs via <img> tag avoid the script risk entirely?
Yes, largely — browsers do not execute scripts inside SVGs loaded via <img> src or CSS background-image, treating them as static images. The risk applies specifically to inline <svg> markup and <object>/<embed> embedding.
Related guides
Ready to Convert Your Image to SVG?
Free online converter — no sign-up, no watermarks, results in under 3 seconds.
Try It Free — Convert Image to SVG