Overview

image/svg+xml is the media type for Scalable Vector Graphics, an XML-based vector image format. It describes drawings with coordinates, shapes, and paths, staying crisp at any resolution and small in size — ideal for logos, icons, and charts.

Details

As the `+xml` suffix indicates, SVG is an XML document, so it can be text-edited, styled with CSS, and manipulated with JavaScript, and transport-layer gzip compresses it very well. That power is also a security risk: SVG can contain `<script>`, `onload` handlers, `<foreignObject>`, and external references, so serving a user-uploaded SVG inline/directly becomes stored XSS.

SVG loaded via an <img> tag does not execute scripts, but opening the SVG as a document or embedding it inline in HTML does run scripts. Untrusted SVG needs defenses: sanitize on the server (e.g. DOMPurify, svg-sanitizer), block scripts with `Content-Security-Policy`, or force download with `Content-Disposition: attachment`.

Syntax

e.g. Content-Type: image/svg+xml

File extensions

Notes

• User-uploaded SVG can carry scripts and event handlers and is an XSS vector — sanitize before inline/direct serving, or force download via attachment.
• Referenced via <img> it does not run scripts, but inline embedding or direct navigation does. The risk depends on how it is served.
• Being XML it compresses very well with gzip — enable transport compression. Without the exact image/svg+xml type it may not render.

Related types

Related headers