SVG without <script> would do just fine.
SVG also supports event attributes, so you should probably strip those too.
alt Hacker News
SVG also supports event attributes, so you should probably strip those too.