A few days ago I read the blog of Romain Gaucher and came across a very simple way of execute Javascript. He wrote there about how to inject a Javascript into an SVG image. It’s not a new technique at all because the SVG format is nothing else then XML and there you can use CDATA for injecting HTML or something else into it and so you can do the same with SVG images. The point is, that until now I never saw that someone did exactly this kind of injection because the main problem we normally have if we do a XML injection is, that we need a functionality which can parse the XML file so that the injected script code can be executed but that’s exactly what happened with SVG images in the webbrowser and so we can use this form to execute our code.

Here you can find an example

PS: Of course you’ll need a browser which supports the SVG format, like Firefox.