An SVG file looks like a picture — open it and you see a logo, an icon, or a diagram. But under the surface it is not a picture at all: it is a text document written in XML, and XML can carry instructions. A single SVG can contain JavaScript, event handlers, links to outside servers, and even embedded HTML. That is what makes SVG powerful — and what makes a downloaded SVG a genuine security risk.
A malicious SVG can run code in a visitor's browser, steal a login session, or redirect a user to a phishing page. The good news: checking an SVG is not hard. This guide walks through the checks that tell you whether an SVG is safe, the free sanitizer professionals rely on, and the safest way to put one on your website.
Why an SVG can run code
Most image formats are just pixels: a PNG or JPG stores colour values in a grid, and nothing in the file can execute. SVG is different — a document format defined by the W3C, with a full document object model: shapes, text, styling, and scripting. The specification allows script elements, event-handler attributes such as onload and onclick, javascript: links, embedded HTML through foreignObject, and references to external files.
None of that is malicious by itself. Interactive diagrams, animated charts, and clickable maps use exactly these features, legitimately. The question is never "does this file contain code" — it is "will the browser run that code, and with whose privileges?" The answer depends entirely on how the file is loaded. The same SVG can be perfectly harmless in one context and a stored cross-site scripting (XSS) vulnerability in another.
That is the blind spot: a user-uploaded SVG is executable code on your own domain. Served back to visitors, its script runs with your site's privileges — reading cookies, making requests as the signed-in user, and injecting content into the page.
Check 1: Open the file as text and look for active content
An SVG is plain text, so the first check costs nothing: open the file in a text editor, not an image viewer, and search for the dangerous pieces. Look for a script element, any attribute starting with "on" (onload, onclick, onmouseover), a foreignObject element, and any href or xlink:href value starting with "javascript:" or "data:". Also look for external references — links to other domains, embedded images loaded from outside, or CSS imports.
A clean logo SVG contains only shapes: path, circle, rect, polygon, and text elements, plus fill and stroke attributes. If you find script, event handlers, or foreignObject in a file that is supposed to be a logo, stop — the file is either built for interactivity you did not ask for, or it is malicious. Delete it and get a clean copy from a trusted source.
One warning: do not try to clean an SVG with text search-and-replace — there are too many spellings, encodings, and hiding places for a hand-written filter to catch. Checking by eye tells you whether a file is suspicious; removing the danger needs a real sanitizer, which is check 3.
Check 2: Ask how the file will be loaded
The same SVG behaves differently depending on how it reaches the browser, and this decides most of the risk:
- Loaded with an img tag: the browser treats the SVG as a static picture — scripts never run, handlers never fire, external resources never load. This is the safe default for any SVG you did not draw yourself.
- Inserted inline (innerHTML or a template): the SVG becomes part of your page, and anything inside it runs with your page's privileges.
- Opened directly at its own URL, or inside an iframe, object, or embed element: its scripts run on the origin that served it — so a direct link to a user-uploaded SVG runs code on your domain.
So the practical rule is simple: display SVGs only through an img tag and the risk stays low. The danger starts when a file is inlined, opened directly, or served from your main domain — and if your site accepts SVG uploads, you need the next checks as well.
Check 3: Run it through a sanitizer
If an SVG must be inlined, or if users can download it, the file must be sanitized. Sanitization means parsing the XML properly and stripping out dangerous elements and attributes against an allowlist of known-safe ones — removing script and foreignObject elements, event-handler attributes, and unsafe link schemes, while keeping the shapes and styling intact.
The tool security guides recommend is DOMPurify, a widely used open-source sanitizer with an SVG profile: it parses the file and returns only the safe markup. For production uploads, sanitize on the server before storage — never trust client-side cleaning alone — and treat it as one layer among several, not the only one.
Just as important is what not to use. SVGO, the popular SVG optimizer, is not a security sanitizer. Its job is to shrink files: removing redundant digits, combining paths, stripping editor metadata. It will happily optimize the coordinates around a malicious script while leaving the script itself untouched. Never rely on minification or optimization as a security boundary.
Check 4: Look for external references and tracking
Even without a script, an SVG can phone home. External href values, remotely loaded images, and CSS imports all send a request when the file is displayed — leaking the viewer's IP address to a third party, or pulling in content the file owner can change later. A logo that loads a remote image is a tracking pixel with a shape attached.
Check every href, xlink:href, image element, and style block in the file. A safe SVG is self-contained: all of its shapes, colours, and text live inside the file itself. If you find references to outside domains, remove them or reject the file. This matters most for files downloaded from marketplaces, free icon sites, or sent by people you do not know.
Check 5: Watch for oversized and malformed files
SVG is XML, so it shares XML's weaknesses — including entity expansion, where a small file defines entities that expand exponentially when parsed, consuming server memory and causing a denial of service. Defend against it by capping the file size you accept, rejecting files that fail to parse as valid XML, and using a parser configured to refuse entity expansion. A logo SVG should be tens of kilobytes, not megabytes.
Check 6: Check where the file came from
The simplest check is also the most overlooked: trust the source. An SVG generated by your own designer, or delivered by a professional tracing service, starts clean. An SVG downloaded from a random free-icon site, attached to an unsolicited email, or pulled from a file-sharing link does not. Free SVG libraries are a known distribution route for malicious files, because most people never open the file as text before using it.
If you must use a file from an unfamiliar source, run checks 1 and 3 first — and prefer artwork redrawn by hand from your own original.
The safe way to use an SVG
Put the checks together and the safe workflow is short:
- Display untrusted SVGs only through an img tag, never inline and never as a direct link from your main domain.
- Sanitize on the server with DOMPurify or an equivalent allowlist sanitizer before storing any uploaded SVG.
- Add a Content Security Policy that forbids inline scripts, so that even if a script slips through, the browser refuses to run it.
- Serve user-uploaded files from a separate sandboxed domain, or with a Content-Disposition attachment header, so code inside them cannot reach your main site's cookies.
- When in doubt, rasterize: converting the SVG to a PNG removes every script, handler, and external reference. You lose scalability, but for a one-off use that trade is worth it.
How AiLogoFix keeps delivered SVGs clean
This is one of the quiet advantages of a hand-redrawn vector file. When AiLogoFix's raster to vector service rebuilds a logo as a vector, a designer draws the artwork shape by shape in professional software. The delivered SVG contains paths, fills, and text — the artwork itself — and nothing else. No scripts, no event handlers, no foreignObject elements, no external references. It is a clean file by construction, because no code was ever part of the drawing process.
The same applies to a logo designed from scratch through the logo design service, or an AI-generated logo rebuilt properly through the AI-generated logo fix service. The file you receive is artwork, not a program. If you have an SVG of unknown origin, getting it redrawn is the most thorough fix available — and you end up with a better file, not just a safer one.
FAQ
Can an SVG file contain a virus?
An SVG is not a traditional virus, but it can carry JavaScript that runs in a browser — a stored XSS payload that can steal session cookies, redirect visitors, or inject phishing content. Treat any SVG from an unknown source as untrusted code until it has been checked and sanitized.
Is it safe to use an SVG with an img tag?
Yes — that is the safest way to display one. Browsers treat SVG loaded through an img tag as a static image: scripts do not run, event handlers do not fire, and external resources are not loaded. The risk appears when the SVG is inlined into the page or opened directly at its URL.
What is DOMPurify and do I need it?
DOMPurify is a widely used open-source sanitizer that cleans HTML, MathML, and SVG. If your website accepts SVG uploads or inlines SVG markup, running uploads through DOMPurify with its SVG profile — on the server, before storage — is the standard defence recommended by security guides.
Does optimizing an SVG with SVGO make it safe?
No. SVGO is an optimizer, not a sanitizer. It shrinks files by cleaning up coordinates and metadata, but it preserves executable content. A malicious script survives SVGO untouched. Never use optimization as a substitute for sanitization.
Should I just convert the SVG to PNG instead?
If you do not need the file to scale or stay editable, converting to PNG is the simplest safety measure — rasterizing removes every script, handler, and external reference. For logos you will reuse at many sizes, a clean SVG is better; for a one-off image, PNG is the zero-risk option.
Conclusion
An SVG is safe when it is treated as what it is: a document that can carry code, not just a picture. Check the file as text, know how it will be loaded, sanitize it before it touches your site, strip external references, and serve uploads from a sandboxed domain. Most of the risk disappears with the img tag alone.
And the cleanest SVG of all is one that never contained code in the first place. A hand-drawn vector file is artwork and nothing else, which is why it is both the safest and the best-looking version of your logo.
Is your SVG safe — or just lucky?
Send us the file and our specialist team will check it, rebuild it by hand as a clean vector if needed, and deliver it as AI, EPS, SVG, and PDF — artwork only, no scripts, no surprises. Every order includes refinements within your selected package and agreed brief, and full commercial rights.
Not sure about a file you downloaded? Message the team — send it over and we will tell you exactly what is inside it, for free.