image/svg+xml
imageThe MIME type for Scalable Vector Graphics (SVG). SVGs are XML-based vector images that scale perfectly at any resolution. Used for logos, icons, illustrations, and charts. The +xml suffix means the file is parseable as XML. SVGs loaded from external sources (img src, CSS background) cannot execute embedded scripts – only inline SVGs can.
Details
image/svg+xml is defined by the W3C SVG specification. The +xml suffix follows RFC 6838 and indicates SVG is structured XML.
Security considerations: - SVGs can contain JavaScript (<script>) and external references - SVGs served as image/svg+xml via <img src> or CSS background: are sandboxed – no JS execution - SVGs inlined directly in HTML (not <img>) execute JS in the document's security context - Never serve untrusted user-uploaded SVGs inline – always use <img> or Content-Security-Policy
Rendering contexts: - <img src="icon.svg">: sandboxed, no JS, no external resources - CSS background-image: url(icon.svg): sandboxed - Inline <svg>: full DOM access, JS executes - <object type="image/svg+xml">: partial sandbox
Charset: SVG is XML and should declare <?xml version="1.0" encoding="UTF-8"?> or include charset=utf-8 in Content-Type.
Common use
Icons, logos, illustrations, charts, UI elements that need to scale
Security note
Never serve user-uploaded SVGs inline. Use <img> tag which sandboxes SVG execution. Untrusted inline SVGs can execute JavaScript.