I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.
Scalable Vector Grief
About this summary. This is a short excerpt from the description that PortSwigger Research published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://portswigger.net/research/scalable-vector-grief
Source attribution: headline and facts are from PortSwigger Research (portswigger.net). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CastleStealer: An Emerging Infostealer Growing More Sophisticated
Table Of ContentsTable of ContentsWhat We Know About CastleStealerWhat Data Does CastleStealer Target?Bypassing App-Bound EncryptionFrom Infostealer to Remote AccessHow…
Vulnerabilities in node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These…
Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known…
Hackers Infect 953 Online Stores With Scanner-Evading Code
Attackers have infected 953 online stores with a scanner-evading JavaScript loader since July 2025
The web’s having a rough week. Here’s how to browse safely
You recognize the website. You’ve visited it before. You may even have it bookmarked.
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept…