Scratch's ongoing security challenges with SVG sanitization
By
varun_ch
Crisp on the outside, thoughtful on the inside. A keeper.
Summary
The article discusses the security challenges Scratch faces with SVG sanitization. Scratch parses user-generated (attacker-controlled) SVG content into the main document for operations like measuring bounding boxes, which is inherently unsafe. The platform has attempted to mitigate this by building increasingly complex infrastructure to parse SVGs and remove dangerous markup, but this approach has proven fragile, leading to a long history of SVG-related vulnerabilities.
Key quotes
· 4 pulledScratch has a long history of SVG-related vulnerabilities.
The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations.
No matter how briefly the SVG remains in the main document, this is an inherently unsafe operation.
Scratch's approach to making this safe has been to build increasingly complex infrastructure around parsing the SVG and the markup within to remove dangerous parts.
You might also wanna read
Why Security Through Obscurity Still Matters as a Practical Defense Layer
The article challenges the common developer mantra that "security through obscurity is bad," arguing that obscurity (like JavaScript obfusca
mobeigi.com·28d ago
CT Log Explorer: A Tool for Browsing Certificate Transparency Logs
CT Log Explorer is a tool for browsing Certificate Transparency logs, which are public records of SSL/TLS certificates issued by Certificate
certs.swerdlow.dev·4mo ago
Svelte Ecosystem Releases Security Patches for 5 Vulnerabilities
The Svelte ecosystem has released security patches for 5 vulnerabilities affecting multiple packages including devalue, svelte, @sveltejs/ki
svelte.dev·4mo ago
Security Warning: Exposed Supabase API Keys Leave Databases Publicly Accessible
The article describes a security vulnerability where developers often leave their Supabase databases publicly accessible by exposing API key
skilldeliver.com·5mo ago
Next.js Security Update: Two New React Server Component Vulnerabilities Identified
Two new security vulnerabilities (CVE-2025-55183 and CVE-2025-55184) have been discovered in React Server Components (RSC) protocol, affecti
nextjs.org·5mo ago
Critical Security Vulnerability in React Server Components (CVE-2025-55182) Allows Remote Code Execution
The React team disclosed a critical security vulnerability (CVE-2025-55182) rated CVSS 10.0 that allows unauthenticated remote code executio
react.dev·5mo ago