---
id: 5498
title: "SVG animate XSS vector"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/svg-animate-xss-vector"
published_at: "2020-09-08T12:22:00Z"
tags: ["browser-security", "web-security", "xss", "payload-obfuscation", "waf-bypass", "svg"]
phying_url: "https://phying.com/item/5498"
lang: en
---

# SVG animate XSS vector

## Summary

Gareth Heyes finds an SVG animate XSS vector that hides a javascript: URL inside the values attribute, using keyTimes and repeatCount to slip past WAFs scanning for the JavaScript protocol.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-09-08T12:22:00Z
- **Original:** https://portswigger.net/research/svg-animate-xss-vector
- **Phying News:** https://phying.com/item/5498