User-uploaded SVG files may embed malicious code or include it via an external reference. When a malicious SVG file is published on your website, it can be used to exploit multiple attack vectors, including:

• Cross-Site Scripting (XSS): executing JavaScript inside the SVG to steal cookies, session tokens, or perform actions on behalf of the user.
• Data exfiltration via external resource loading: Using <image>, <script>, or <use> tags to send sensitive information to attacker-controlled servers.
• Phishing overlays: creating deceptive clickable areas or visual elements to trick users into revealing credentials.
• Local file access: embed <image xlink:href="file:///..."> or <use> references to attempt to read local or server-side files.

Indeed, wrapping the image in an <img> tag is 1 of the 3 measures you can take. Other measures are

• applying Content Security Policy (CSP) header
• server side sanitization of the SVG file.

More detailed guidance on each measure:

1: Wrap the SVG in an <img> Tag

Instead of directly embedding an SVG using <svg> or <object>, use the <img> tag to render it:

<img src="safe-image.svg" alt="Safe SVG">

The <img> tag ensures that the SVG is treated as an image and prevents JavaScript execution inside it, but it doesn’t remove malicious code from the SVG file.

2: Apply a Content Security Policy (CSP) header

Enabling the Content Security Policy (CSP) HTTP response header also prevents JavaScript execution inside the SVG.

For example:

Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'none'; script-src 'none'; sandbox

Which applies the following policy:

3: Server-side sanitization of uploaded SVGs

Strip potentially harmful elements like <script>, <iframe>, <foreignObject>, inline event handlers (e.g. onclick) or inclusion of other (potentially malicious) files.

Examples of libraries for SVG sanitization:

• Java: SVG Sanitizer¹
• JavaScript: DOMPurify
• PHP: svg-sanitizer
• Python: py-svg-hush

¹ I started the mentioned Java sanitizer project, as I could not find any solution for Java.

Alternative: Rasterize SVG server-side

Render the SVG server side to a raster based format, like PNG. This may protect visiting users, but could introduce vulnerabilities at the rendering side at the server, especially using server side JavaScript (like Node.js).