SVG Security Scanner & Sanitizer
Scan SVG markup for scripts, event handlers, executable URLs, foreignObject and remote references, then create a sanitized copy.
The original SVG is never rendered before the security scan.
Scan an SVG before embedding or uploading it
SVG is XML, not just a passive bitmap. It can contain script elements, event-handler attributes, embedded HTML and external references. That flexibility is useful, but it also means untrusted SVG files deserve a security review before they are rendered in a CMS or web application.
What this scanner checks
The tool flags script and foreignObject elements, inline event handlers, executable URL schemes, risky CSS patterns, DOCTYPE/entity declarations and remote resource references.
Sanitized output
The sanitize option removes the active patterns covered by these checks and creates a new SVG string for review and download. The original file is not changed.
Safe workflow
- Paste SVG markup or choose a local SVG file.
- Run the scan before previewing the file elsewhere.
- If needed, create a sanitized copy and visually compare it with the trusted source artwork before deployment.
Security scope
No lightweight browser sanitizer can certify arbitrary SVG as universally safe in every embedding context. Treat the report as a focused defensive check and keep server-side allow-listing in security-sensitive upload systems.