SVG with an external entity (XXE test)

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

An SVG is a document that can run script, so an uploaded one is an XSS risk when served inline. This screen is triage, not a sanitiser: serve user SVGs from a separate domain with a strict Content-Security-Policy, or rasterise them.

import re

RISKS = [
    (r"<!ENTITY|<!DOCTYPE[^>]*\[", "declares entities (XXE)"),
    (r"<script\b", "contains <script>"),
    (r"\son[a-z]+\s*=", "has an on* event handler"),
    (r"(?:href|src)\s*=\s*[\"']?\s*javascript:", "links to javascript:"),
    (r"<foreignObject\b", "embeds HTML in foreignObject"),
    (r"(?:href|src)\s*=\s*[\"']?\s*https?://", "loads an external resource"),
]
with open("svg-external-entity.svg", encoding="utf-8") as f:
    svg = f.read()
found = [label for pattern, label in RISKS if re.search(pattern, svg, re.I)]
print("unsafe to serve inline: " + ", ".join(found) if found else "no active content found")

Run against this file, it prints: unsafe to serve inline: declares entities (XXE)