# SVG animate javascript URI sanitizer bypass

Sanitizers that allow SVG animate elements or trust static href without checking animated attribute targets

_Area: Web injection and code execution. Seen in 3 disclosed reports; latest 2026-09-10. Updated 2026-10-31._

## How it works
A sanitizer approves markup by inspecting element names and attribute values as they appear at parse time. SVG animation elements break that assumption: `<animate>` can set an attribute such as `xlink:href` to a `javascript:` URI at runtime, after the sanitizer has already passed the markup. The sanitizer checks the static `href` it sees, not the value the animation will write, so a `javascript:` URI survives into the rendered DOM and executes in the app origin [E3](https://bugbountylibrary.com/r/h1%3A271007.md).

## Where it shows up
- Allowlists that keep SVG `animate`, `set`, `animateTransform`, or `animateMotion` elements [E3](https://bugbountylibrary.com/r/h1%3A271007.md)
- Sanitizers that validate `href`/`xlink:href` statically but not `attributeName`/`to`/`values` targets [E3](https://bugbountylibrary.com/r/h1%3A271007.md)
- Markdown or rich-text renderers that sanitize before a second parse step [E3](https://bugbountylibrary.com/r/h1%3A271007.md)
- Known sanitizer bypass corpora (e.g. DOMPurify mXSS payloads) applied to a custom Markdown pipeline [E3](https://bugbountylibrary.com/r/h1%3A271007.md)

## How to review
The invariant: no element or attribute that can write a URI at runtime may reach the DOM with a `javascript:` (or equivalent) value. Concretely: confirm the sanitizer's allowlist excludes SVG animation elements entirely, or that it validates the animated attribute target and value, not just the static attribute [E3](https://bugbountylibrary.com/r/h1%3A271007.md). Confirm the sanitizer runs on the final markup that reaches the DOM, not an intermediate form that a later parse can reshape [E3](https://bugbountylibrary.com/r/h1%3A271007.md).

## Variants seen
- SVG `<animate>` setting `xlink:href` to a `javascript:` URI past a Markdown sanitizer [E3](https://bugbountylibrary.com/r/h1%3A271007.md)

## Impact and severity
Stored XSS executing in the application origin when a published note is viewed and clicked, enabling session/token theft and account takeover [E3](https://bugbountylibrary.com/r/h1%3A271007.md). Severity rises because the payload is stored and served to other users who view the note [E3](https://bugbountylibrary.com/r/h1%3A271007.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A309531.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-jmc6-2wr8-h3wj.md
- E3: https://bugbountylibrary.com/r/h1%3A271007.md