News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by lambdaone on Thursday December 18, 2025 @03:07PM (#46317934)
SVG without <script> would do just fine.
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by naasking on Friday December 19, 2025 @03:09PM (#46330304)
SVG also supports event attributes, so you should probably strip those too.
[ Parent | on HN ]