Is this SVG safe? How to check for hidden scripts and external references
You just downloaded a bundle of 200 SVGs. Before they go anywhere near your shop, your cutting machine workflow, or your customers, it is worth knowing something most marketplaces will not tell you: an SVG is a text file, and a text file can carry instructions.
What an SVG can carry
Unlike a PNG or a JPG, an SVG is written in a markup language a browser can interpret. That means a crafted SVG can contain things a picture has no business containing:
- Script tags - embedded code that runs when the file is opened in a browser.
- Event handlers - attributes like onload that trigger code when the image renders.
- External references - links that pull images, fonts, or other content from an outside server when the file is viewed. That outside server sees the view happen, and controls what gets served next time.
Most bundle SVGs contain none of this. The point is that “it’s just an image” is not guaranteed by the file extension, and the only way to know is to look.
How to look, safely
Open the SVG in a text editor. Not a browser: a browser is the one program that will actually run whatever is inside. Any plain text editor works.
Once it is open, search the text for a handful of strings:
script- there is no legitimate reason for a cutting-file SVG to contain a script tag.onload,onclick, or any attribute starting withon- event handlers.iframeandforeignObject- ways to embed outside content.http- external references. Namespaces (thexmlnslines at the top) will match this search and are normal; what deserves a second look is anhttplink that loads an image, font, or stylesheet from outside the file.
What is normal: XML namespaces, comments, long path data, editor metadata from Illustrator or Inkscape. What deserves a second look: anything from the list above that is not a namespace line. A second look means reading what the element does before deciding, and when in doubt, not using the file.
Where the manual pass stops
One SVG, two minutes. A 50-design bundle with folders inside folders is a different afternoon, and attention is exactly what fails at file thirty. This is the kind of check that software is genuinely better at: the same rubric, file after file, no fatigue.
A BundleShield preflight flags files that carry unsafe active content or external references and names the file and the exact finding in your report, so you know where to look. Unsafe active content lands as Remove in the report; external references land as Review. It is a flag for your review, not a malware verdict: the report shows what is detectable in the file, and the call stays with you.
One ZIP, up to 50 SVG or PNG designs with the license text file inside. Flat $9.90 per bundle, report by email within 24 hours of a completed check.