Yeah this is a big part of the reason SVGs are dangerous if treated like normal image files. They are basically equivalent to HTML w/ embedded CSS and can even execute javascript.

If you aren't careful they can be used for XSS and all kinds of nasty stuff.

They are also super useful in general though despite that.