JS in SVGs can be dangerous, but you can mitigate it using a CSP or by sending "Content-Disposition: attachment" so the file will be downloaded instead of being executed in your current browser context.

Fortunately svg and (x)HTML aren't too horrible in being able to sanitize scripts or if. The use of CSS's access notwithstanding.