Anything SVG does maliciously, it does by containing JavaScript, so SVG's worst case is a subset of JS's.