The safest workflow treats an SVG from an unknown source as untrusted input until it has been reviewed. Avoid opening suspicious files in a privileged application, do not insert unreviewed markup with innerHTML, and understand the rendering context before you preview or publish it. For standards background, see the MDN SVG documentation.
What deserves review
| Input feature | Why review it | Safer next step |
|---|---|---|
<script> and event attributes | Executable behavior or event-driven code can be unsafe in an application context. | Remove active content, then inspect the output and your rendering policy. |
<foreignObject> | Embeds HTML-like content whose behavior depends on the browser and context. | Remove it when the destination only needs vector shapes. |
External href, src, and CSS URLs | References can fetch external content or make output dependent on a remote resource. | Prefer local fragment references or reviewed data images where appropriate. |
| Filters, masks, and embedded images | Complex effects can change rendering or increase processing cost. | Preview in the target browser and keep the original source. |
| Metadata, title, and description | May contain creator, licensing, or accessibility information. | Remove only what you understand; preserve meaningful records. |
Cleanup is not the same as sanitization
Clean SVG and Remove SVG Metadata are focused document operations. They can remove editor noise or selected metadata, but they are not a universal security sanitizer. A security boundary needs a policy appropriate to the application, a carefully reviewed allowlist of elements and attributes, safe URL handling, and tests in the actual rendering context.
FromSVG’s Repair SVG and Analyze SVG tools can help inspect or correct a file, but generated output still needs application-level review. Do not use an optimizer as proof that an SVG is safe to display to every user.
Example of content that should not pass through blindly
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10">
<script>/* active content: review and remove */</script>
<image href="https://example.test/remote-image.png" />
<rect width="10" height="10" onclick="doSomething()" />
</svg>Do not copy this markup into an application simply because it is syntactically valid XML. Remove or reject features according to your policy, and test the final output.
Browser-local processing and privacy
FromSVG processes the SVG content in the browser for its client-side tools, so the file is not uploaded to a processing server. That statement does not mean that every browser preview, third-party application, extension, or hosting environment handles an SVG the same way. Read the site’s Privacy Policy for the distinction between local processing and ordinary website requests or hosting logs.
Security review checklist
- Identify the source and treat unknown SVG as untrusted input.
- Reject or remove scripts, event-handler attributes, unsafe URLs, and unsupported embedded content.
- Decide whether titles, descriptions, licenses, and attribution must be preserved.
- Preview the result in the target context without granting unnecessary privileges.
- Keep a reviewed source and test the allowlist or sanitizer in automated security tests.