XSS on using the legacy "Graphie To PNG" API

I had no idea svg files allowed embedded JavaScript. What a great find