A new report links over 500 weaponized SVGs to a phishing campaign that spoofed a Colombian government portal.

Scalable vector graphics (.svg) files are lightweight, XML-based images that render at any resolution. They’re usually harmless, but they can also contain active code, and hackers appear to be relying on them more often as a means to stealthily deliver malware.

    • ISO@lemmy.zip
      3·
      2 months ago

      resvg/usvg is a good implementation if you’re looking for one.

      • ulterno@programming.devEnglish
        1·
        2 months ago

        Nice.
        Perhaps would be useful for someone making a Lemmy Client.

        My thoughts were more in the lines of:

        • Firefox probably supports the JS in SVG
        • I would expect Inkscape to not execute the JS, but let it be when edited and saved.
        • For normal viewers on the desktop, I’d expect JS to be fully ignored.