News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by auxiliarymoose on Friday December 19, 2025 @02:19AM (#46323098)
Also remember that if the untrusted SVG file is served from the same origin and is missing a `Content-Disposition: attachment` header (or a CSP that disables scripts), an attacker could upload a malicious SVG and send the SVG URL to an unsuspecting user with pretty bad consequences.

That SVG can then do things like history.replaceState() and include <foreignObject> with HTML to change the URL shown to the user away from the SVG source and show any web UI it would like.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by socalgal2 on Friday December 19, 2025 @01:23PM (#46329089)
how is that special/different from an HTML URL?
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by auxiliarymoose on Friday December 19, 2025 @07:44PM (#46332707)
Because displaying user-submitted images is pretty common and doesn't feel like a security footgun, but displaying user-submitted HTML is less common (and will raise more careful security scrutiny).
[ Parent | on HN ]