SVGMend

SVG sanitizer

Remove scripts and trackers from SVG

SVG is code: it can run JavaScript and load files from other servers. Clean SVGs from users, clients or the web before you put them on your site, and see exactly what was taken out.

Runs in this tab. Nothing is uploaded.

Keep

Report

Paste an SVG or try the malicious sample.

Clean result

Sanitized code


					

					
				

			

			

				

				
				
				
				
			

		

	


	

		

			

				
What gets removed

				
    
					
  • Scripts and handlers: <script>, every on… attribute, and animations (<set>, <animate>) that rewrite links or handlers.
    • 
					
  • Dangerous links: javascript:, vbscript: and data: links, including ones hidden with entities, tabs or odd capitalization, and under any XLink prefix.
    • 
					
  • Embedded HTML: <foreignObject> and anything in the XHTML namespace.
    • 
					
  • External references: <use> pointing outside the file, remote images, @import, remote url() in CSS and attributes, xml-stylesheet and xml:base. These can track whoever views the image.
    • 
					
  • Everything else that isn’t plain SVG: unknown elements, foreign-namespace attributes, DOCTYPE and entity declarations.
    • 
				

				
SVGMend uses an allowlist of SVG elements instead of hunting for known tricks, and checks every attribute and URL after decoding entities. The output is well-formed XML that is also safe to paste into HTML. For very high-risk uploads, also serve SVGs from a separate domain or convert them to PNG.

			

			
		

	


	

		

			
Questions

			

				
Can an SVG really contain malware?
An SVG opened directly in a browser, or pasted into a web page, can run JavaScript just like HTML. That can steal sessions on the site that hosts it. As an <img> it can’t run scripts, but it can still be opened on its own.

				
Is it safe to paste a malicious SVG into this page?
Yes. SVGMend parses the code as text and shows the cleaned result only as an image, so nothing in the file runs here.

				
Will sanitizing change how the image looks?
Normal artwork stays the same. Things that depend on removed features change: HTML in foreignObject, external images and fonts, and CSS loaded from other servers.

			

		

	


	




	

		

			

				
More SVG tools