Commit 09dd38825 for imagemagick.org

commit 09dd388256f742ed8adfd2515cfc4fe5b8e22073
Author: Naveed Khan <164054284+rootvector2@users.noreply.github.com>
Date:   Tue Nov 3 22:16:37 2026 +0530

    escape mvg comment token in WriteSVGImage (#9086)

diff --git a/coders/svg.c b/coders/svg.c
index c37827190..0b6b04882 100644
--- a/coders/svg.c
+++ b/coders/svg.c
@@ -3958,7 +3958,9 @@ static MagickBooleanType WriteSVGImage(const ImageInfo *image_info,Image *image,
             active=MagickFalse;
           }
         (void) WriteBlobString(image,"<desc>");
-        (void) WriteBlobString(image,keyword+1);
+        escaped_token=EscapeSVGAttributeValue(keyword+1);
+        (void) WriteBlobString(image,escaped_token);
+        escaped_token=DestroyString(escaped_token);
         for ( ; (*q != '\n') && (*q != '\0'); q++)
           switch (*q)
           {
diff --git a/tests/cli-svg.tap b/tests/cli-svg.tap
index 882483c07..2baad8d4d 100755
--- a/tests/cli-svg.tap
+++ b/tests/cli-svg.tap
@@ -18,7 +18,7 @@
 #
 . ./common.shi
 . ${srcdir}/tests/common.shi
-echo "1..2"
+echo "1..3"

 # gradientTransform should not cause a double-free / SIGABRT (#8582)
 ${MAGICK} ${SRCDIR}/input_svg_gradient_transform.svg null: && echo "ok" || echo "not ok"
@@ -33,4 +33,12 @@ case "$msvg_mode" in
     ;;
   *) echo "ok # SKIP MSVG coder unavailable" ;;
 esac
+
+# MVG comments written to the SVG <desc> element must be XML escaped.
+svg=`printf '%s\n' 'viewbox 0 0 4 4' '#x(<script>)' |
+  ${MAGICK} MVG:- SVG:- 2>/dev/null`
+case "$svg" in
+  *'<desc>x(&lt;script&gt;)</desc>'*) echo "ok" ;;
+  *) echo "not ok" ;;
+esac
 :