Is an SVG safe to upload or embed? Remove scripts and event handlers
Last reviewed 2026-09-19
SVG is an image format built on XML, and it can contain <script> blocks, event handler attributes (onload, onclick) and javascript: links. If a site shows such a file inline, the script can run in a visitor's browser, which is why many platforms block SVG uploads.
Messages you might see
- “SVG upload blocked for security reasons”
- “An SVG contains <script> or onload= attributes”
Why it happens
- The SVG came from an untrusted source or generator.
- An editor or export tool added scripts, animations or interaction.
- A platform's upload filter rejects any SVG with active content.
Try this first (free, no tool needed)
- Open the file in a text editor and search for `<script`, `onload=`, `onclick=` and `javascript:`.
- If you only need a picture, export to PNG or WebP instead. It has no active content at all.
- Serve uploaded SVGs as images (with an img tag), not inline, and with a strict content security policy.
If that didn't work
These tools run in your browser. Your file is read and repaired on your own device and is never uploaded.
SVG Sanitizer
Removes <script> blocks, inline event handlers, javascript: URIs and other unsafe content from an SVG before you embed it anywhere. Cleaning reduces risk but is not a substitute for your own platform's protections, so keep serving untrusted SVGs as images.
Open SVG SanitizerCommon questions
Does the sanitised SVG look the same?
Static drawings look the same. Anything that depended on a script or a removed handler will stop working, which is the point.
Is my file uploaded anywhere?
No. The tool runs as a program inside your own browser, so the file is read and repaired on your device and never sent to a server.