Similar to this problem, we first try to find out which tags are allowed and which are not using Intruder as follow: The tags available are animateTransform, image, and svg. title is also allowed but it doesn’t assist much in delivering payloads so we will skip it for now.

So we are given three building blocks. One may craft a payload as follow:

<svg><image width=10 height=10 src/onerror=alert(1)></svg>

But it doesn’t work. Using animateTransform to add the event indirectly also does not work. Using other events does not work. Once again, we use Intruder to brute our way to which events are accepted and which aren’t: All but one event is blocked, and that is onbegin. It is essentially onload but for SVG animation elements. So we can craft a payload as follow:

<svg><image><animateTransform onbegin='alert(1)'/></image></svg>