News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by zahlman on Friday December 19, 2025 @03:44PM (#46330683)
Yeah, it's still insane to me that the SVG can contain scripts. Wholly unnecessary; the DOM subtree it defines could be manipulated by external scripts just fine.

Anyway, I just set `svg.disabled` in Firefox. Scary world out there.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by zahlman on Friday December 19, 2025 @07:05PM (#46332447)
Update: this breaks quite a few things. It seems legitimate SVGs are used more often for UI icons than random diagrams and such. I suppose I shouldn't be surprised. I'll have to rethink this.
[ Parent | on HN ]