Collected research

XSS fun with animated SVG

@phaldrzynski and Paweł Hałdrzyński · blog.isec.pl · 14 April 2020

The SVG animate element takes a semicolon separated values list, so a javascript URL hidden after a harmless one escapes WAFs that inspect the attribute as a whole. Setting keyTimes to skip the first frame, or fill=freeze with a 1ms duration to land on the last, makes that value the one applied to href, giving a click-triggered XSS.

Record

Researcher

@phaldrzynski and Paweł Hałdrzyński

Published by

blog.isec.pl

Date

14 April 2020

Topic

XSS

In the archive

• Collected in the 2020 research round

Tags

• xss
• waf-bypass
• filter-bypass
• encoding
• url-parsing
• javascript
• prior-art-extension
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of @phaldrzynski and Paweł Hałdrzyński, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.