News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by staticassertion on Thursday December 18, 2025 @10:31PM (#46322009)
No, svgs can do `onload` and `onerror` and also reference other svgs that can themselves contain those things (base64'd or behind a URI).

But you can use an `img` tag (`<img src="evil.svg">`) and that'll basically Just Work, or use a CSP. I wouldn't rely on sanitizing, but I'd still sanitize.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by collinmanderson on Friday December 19, 2025 @09:39AM (#46326332)
> But you can use an `img` tag (`<img src="evil.svg">`) and that'll basically Just Work

That doesn't help too much if evil.svg is hosted on the same domain (with default "Content-Type: image/svg+xml" header), because attacker can send a direct link to the file.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by GoblinSlayer on Friday December 19, 2025 @12:04PM (#46328141)
Reddit horribly breaks direct links to images and serves html instead.
[ Parent | on HN ]