SVG smuggling is the abuse of Scalable Vector Graphics files to hide active or deceptive content inside something that looks like a harmless image. Unlike a flat bitmap, an SVG is XML-based and can contain links, scripts, embedded data, or other payloads. That makes it useful for attackers who want malware delivery to blend into normal user behavior.
This matters because people often trust image attachments and preview them without caution, especially in email, recruiting, or developer workflows. In real attacks, a malicious SVG may open in a browser, trigger a redirect, load remote content, or deliver the next-stage payload. Defenders should treat SVGs as potentially active content: inspect them as text, strip scripts and external references, sandbox unknown files, and watch for unusual behavior after an image is opened.