---
id: py-svg-hush
version: "0.3.0"
license: unclear
license_treatment: unclear
maintenance: aging
---

# py_svg_hush

License: unclear · Maintenance: aging · Downloads: 82.5K/mo

## What it is and what it does

py-svg-hush is a Python wrapper around Cloudflare's svg-hush Rust library that removes potentially malicious content from SVG files. It provides a single function, filter_svg, which takes SVG bytes and an optional dictionary of allowed MIME types for data URLs, then returns sanitized SVG bytes. The package strips dangerous elements and attributes while enforcing a whitelist of permitted data URL MIME types—any data URL whose type is not in the whitelist is dropped entirely.

The package is built as a compiled extension using Rust bindings, which means installation requires downloading or building wheels for your platform and Python version. It supports Python 3.10 through 3.14 on CPython and PyPy, with prebuilt wheels available for common architectures. The API is minimal and straightforward: one function call with two parameters, raising ValueError or TypeError on invalid input.

Use it for:

- Sanitize user-uploaded SVG files in a web application before storing or displaying them.
- Strip embedded scripts and event handlers from SVG graphics in a content management system.
- Enforce a whitelist of allowed image MIME types in SVG data URLs to prevent unexpected content injection.
- Batch-process a collection of SVG files to remove known attack vectors before distribution.
- Validate SVG safety in a document processing pipeline that accepts external graphics.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Sanitizes SVG files by removing malicious elements, attributes, and restricting data URL MIME types through a Python wrapper around the svg-hush Rust library.

Yes, if you need to sanitize untrusted SVG input and can accept the license uncertainty. The package is straightforward, has no runtime dependencies, and benefits from battle-tested Rust logic. However, verify the license terms before use in proprietary or commercial contexts, and confirm that svg-hush's threat model matches your security requirements. The aging maintenance status (182 days since last release) is not a blocker for a stable utility, but monitor the repository for security updates.

## Install

pip install py-svg-hush
uv add py-svg-hush
poetry add py-svg-hush

## Installing py_svg_hush

Before you install: Medium install friction due to compiled Rust bindings; wheels are available for Python 3.10–3.14 across Linux, macOS, and Windows. Last commit was 182 days ago and the project is marked as aging, though the repository remains active and unarchived.

License in practice: License status is unclear—no SPDX identifier or raw license text is recorded in the package metadata, so the legal terms for use and redistribution cannot be determined from the fact sheet.

Quickstart:

pip install py-svg-hush

from py_svg_hush import filter_svg

svg_bytes = b'<svg>...</svg>'
keep_data_url_mime_types = {"image": ["jpeg", "png", "gif"]}
sanitized = filter_svg(svg_bytes, keep_data_url_mime_types)

Requires Python 3.10 or later.

Verify before relying:

- Whether the underlying svg-hush Rust library's security model and threat coverage are documented or audited.
- What specific malicious elements and attributes are removed by filter_svg beyond data URL filtering.
- Whether the package is actively maintained or in maintenance-only mode given the 182-day gap since last release.

## Package facts

- License: not declared (unclear)
- Python support: supports_current
- Install friction: medium
- Maintenance: aging
- Downloads: 82.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

svg sanitization, remove malicious svg content, svg security filtering, svg data url filtering, svg xss prevention, svg element stripping, svg-security, rust-bindings

[View on SkillFed](https://skillfed.io/packages/py-svg-hush) · [View on PyPI](https://pypi.org/project/py-svg-hush/)