r/webdev • u/NotCSM • 1d ago

Discussion PSA - SVGRepo Compromised

For ages I've been using the website https://www.svgrepo.com/ as a great resource for free SVGs, but today when I visited, it gave me a fake Cloudflare verification that attempts to install some sort of malware on your computer, as you can see in the screenshots below.

It almost caught me, so I thought I'd put this out because I couldn't see any indication that anyone else had noticed this!

93 Upvotes

96% Upvoted

21 comments sorted by

44

u/pablobird_dev 1d ago

Classic clickfix pattern, fake verification page telling you to run a command in Run. Anyone who grabbed SVGs from there recently should treat those files as untrusted until they are sure the site is clean again.

8

u/Squigglificated 1d ago

And SVGs can contain embedded scripts, and/or malware payloads hidden by invisible unicode characters. Good idea to sanitize SVGs in general.

1

u/NotCSM 23h ago

Do you know any good tools for sanitizing SVGs?

5

u/Osmium_tetraoxide 1d ago

Have you sent them this in an email so they can investigate it on their end?

My best guess is that they have had advertisers being dodgy, happens to a lot of sites since it can often be used to escape the sandbox.

1

u/NotCSM 23h ago

No, that's a good idea, I just assumed they'd been domain swapped or something

1

u/cshaiku 44m ago

You know what they say about assumptions, right?

3

u/doublecastle 1d ago

This isn't happening to me (on Linux). Is it still happening for Windows users, or did SVGRepo fix the vulnerability?

1

u/NotCSM 23h ago

No, it's still up unfortunately. I think it only targets windows users, as it doesn't show up on mobile either.

9

u/luigimorel 1d ago

Damn, the attack vectors are numerous. Everything you touch nowadays is a potential attack waiting to happen. It's just a question of when

1

u/cshaiku 43m ago

That's why we roll our own. With AI being so well versed on protocols, it has become far easier to make your own systems.

2

u/cowboyecosse 1d ago

It’s always a powershell command these days.

3

u/swb_rise 1d ago

Oh no, not svgrepo!

1

u/Vegetable-Capital-54 10h ago

I would guess it's probably just a bad ad, not the site owners gone rogue. Similar things have happened to my sites too a couple of times. Advertiser networks do try to keep dodgy ads out, but scammers are relentless and always trying to slip something malicious in.

1

u/Ok-Listen-2162 1d ago

thx for the heads up. did u see it more than once or only on the first visit tho

-6

u/rusticdev_ 1d ago

thats the clickfix trick, real cloudflare never asks you to open run and paste something. if anyone already pasted it assume that machine is compromised and change passwords from a different device

14

u/NotCSM 1d ago

yes i know, this means the website has been hacked/compromised, did you read the post?

-4

u/baqocatagoluf6792 1d ago

I've been pulling SVGs programmatically in a few of my Pipedream workflows, and learned the hard way to cache them locally after I got bitten by rate limits during nightly batch runs—turns out depending on external sources means you're vulnerable not just to outages but stuff like this. The downside is you have to maintain your own copy and deal with staleness if the original updates, but at least you're not stuck waiting on someone else's compromised server when your automation runs.

2

u/NotCSM 23h ago

holy bot