Using the "set" tag to add a remote/data/script target to any attribute is blocked. Found <set to="$1"> in the uploaded SVG file.