Is there a way to execute XSS in an HTML img tag with SVG?
No, it's not. Although SVG files can contain JS (see this), these will only get executed if:
- the user directly visits the
.svg
file in their browser - the image is embedded within
<embed>
tags.
Modern browsers will never execute scripts in SVGs if it's within <img>
tags.
And even in the two cases above, the server can provide CSP headers that stop the execution of such scripts.