And more. I got a bug bounty by uploading a malicious svg witch would get parsed and fetch external resources, even read local images.
If your app receives and parses svg server side you might have a hole there.
If your app receives and parses svg server side you might have a hole there.
You got me interested there ;)
Now that you got me thinking, SVG might be a decent, if somewhat large, format for accepting sketches from users. Something like "draw a map, and we'll find it on Google maps for you". But I am certain that that (SVG user input) isn't a thing yet.