A recent incident involved spammers that leveraged Facebook to conduct a campaign to infect unsuspecting victims with the Locky ransomware. This malware is unforgiving and is designed to encrypt users’ files and hold them for extortion.
SVG images are also used on websites, making them a target. If attackers hack a website and replace the current SVG files with ones containing malware, then visitors to that site may become infected. By the time the company realizes its Web page has been infecting its customers, the situation may turn into a catastrophic business debacle.
Many organizations implement strong precautions and security to protect their internal networks from external threats, but not as many are vigilant in watching code on their websites for minor graphical changes.
Technology is great and can be used to do wonderful things. SVG files offer many advantages as graphics go, but they can be abused. Without sufficient controls to protect potential victims, I recommend blocking SVG files on social media sites. Although extreme, it may be prudent to also abandon the use of SVG images on websites until security software can catch up with features to test such embedded code for malicious actions with a high degree of confidence.