SVG stands for Scalable Vector Graphics, an XML-based image format used for logos, icons, diagrams, and other graphics that need to scale cleanly. Because SVG files are text-based, they can contain structured data, embedded scripts, and references to external resources, which makes them more flexible than many other image formats.
In cyber security, that flexibility can be abused. Attackers may hide malicious payload material inside an SVG file, use it as a container in a multi-stage chain, or rely on steganography and obfuscation to make a file look harmless. If defenders treat SVGs as inert images, they may miss suspicious content that is delivered through normal workflows such as downloads, job-test attachments, or repository assets. Security teams should inspect unexpected SVGs, restrict script execution in browsers and viewers, and monitor for follow-on activity like archive extraction, script launch, or credential theft. In short, SVG is safe by design, but unsafe handling can turn it into a malware delivery layer.