Hacker News Reader

If linked via an <img> tag, browsers will run the SVG in a script-less context. The problem is direct linking, then you have a potential XSS.

Here it’s the CSP directive (Content-Security-Policy: script-src ‘none’) which is neutering it, as indicated by the comment your got the SVG from.

However from what I remember of my experiments script-src none can severely degrade SVGs even though they don’t use JS, because it affects some styling.

According to the page the HTTP CORS headers prevent JS execution. But the problem remains that svg can embed and execute JS on servers without these non-default headers.

CSP, not CORS.

CORS is for allowing other origins to read resources (and send special requests/special headers). It's not really relevant here.

If you save it locally then drag it into your browser, it will run.

Bert blocked it from running when hosted on his domain a couple days ago https://github.com/berthubert/trifecta/commit/ed7a10d783dda2...