diff --git a/package.json b/package.json
index 8743467b56..74921c60f5 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "player:perf": "bun run --filter @hyperframes/player perf",
     "format:check": "oxfmt --check .",
     "knip": "knip",
-    "test:scripts": "node --import tsx --test scripts/animejs-v4-guidance.test.mjs scripts/check-tracked-artifacts.test.mjs scripts/check-registry-set-delta.test.mjs scripts/check-no-main-deletions.test.mjs scripts/check-pr-captures.test.mjs scripts/check-docs-snippet-motion.test.mjs scripts/registry-target-paths.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-media-use-copy-parity.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/check-large-files.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/publish-workflow.test.mjs scripts/install-workspace-dependencies.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/catalog-payload-assets.test.ts scripts/host-registry-assets.test.ts scripts/catalog-preview-temp.test.ts scripts/catalog-hosted-files.test.ts scripts/player-cdn-pin.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs scripts/creator-editing-recipes.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs packages/core/scripts/writeGeneratedFile.test.ts scripts/catalog-drift.test.ts scripts/catalog-fetch-mirror.test.ts scripts/catalog-script-inlining.test.ts scripts/catalog-detail.test.ts scripts/generate-catalog-pages.test.ts scripts/verify-catalog-payloads.test.ts scripts/registry-skill-files.test.ts scripts/creator-editing-capabilities.test.mjs scripts/generate-catalog-previews.test.ts scripts/registry-primitive-payloads.test.ts registry/components/pan-stations/pan-stations.test.mjs && vitest run scripts/catalog/ scripts/contrastRatchet.test.ts scripts/generate-catalog-payloads.test.ts",
+    "test:scripts": "node --import tsx --test scripts/animejs-v4-guidance.test.mjs scripts/check-tracked-artifacts.test.mjs scripts/check-registry-set-delta.test.mjs scripts/check-no-main-deletions.test.mjs scripts/check-pr-captures.test.mjs scripts/check-docs-snippet-motion.test.mjs scripts/registry-target-paths.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-media-use-copy-parity.test.mjs scripts/check-svg-sanitize-parity.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/check-large-files.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/publish-workflow.test.mjs scripts/install-workspace-dependencies.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/catalog-payload-assets.test.ts scripts/host-registry-assets.test.ts scripts/catalog-preview-temp.test.ts scripts/catalog-hosted-files.test.ts scripts/player-cdn-pin.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs scripts/creator-editing-recipes.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs packages/core/scripts/writeGeneratedFile.test.ts scripts/catalog-drift.test.ts scripts/catalog-fetch-mirror.test.ts scripts/catalog-script-inlining.test.ts scripts/catalog-detail.test.ts scripts/generate-catalog-pages.test.ts scripts/verify-catalog-payloads.test.ts scripts/registry-skill-files.test.ts scripts/creator-editing-capabilities.test.mjs scripts/generate-catalog-previews.test.ts scripts/registry-primitive-payloads.test.ts registry/components/pan-stations/pan-stations.test.mjs && vitest run scripts/catalog/ scripts/contrastRatchet.test.ts scripts/generate-catalog-payloads.test.ts",
     "typecheck:scripts": "tsc --noEmit -p scripts/tsconfig.json",
     "test:skills": "node --test 'skills/**/*.test.mjs' 'packages/cli/src/media-use/**/*.test.mjs'",
     "generate:previews": "tsx scripts/generate-template-previews.ts",
diff --git a/packages/cli/src/media-use/lib/freeze.mjs b/packages/cli/src/media-use/lib/freeze.mjs
index dbfc12741d..b8ca20e50f 100644
--- a/packages/cli/src/media-use/lib/freeze.mjs
+++ b/packages/cli/src/media-use/lib/freeze.mjs
@@ -1,5 +1,5 @@
 import { fetchMedia, isPublicMediaUrl } from "./media-fetch.mjs";
-import { sanitizeSvg } from "@hyperframes/core/sanitize-svg";
+import { sanitizeSvg } from "./svg-sanitize.mjs";
 import { writeFileSync, copyFileSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname } from "node:path";
 
diff --git a/packages/cli/src/media-use/lib/svg-sanitize.mjs b/packages/cli/src/media-use/lib/svg-sanitize.mjs
new file mode 100644
index 0000000000..21b435e087
--- /dev/null
+++ b/packages/cli/src/media-use/lib/svg-sanitize.mjs
@@ -0,0 +1,36 @@
+// Port of packages/core/src/figma/sanitizeSvg.ts; parity enforced by scripts/check-svg-sanitize-parity.test.mjs.
+
+function replaceStable(input, pattern, replacement) {
+  let out = input;
+  let prev;
+  do {
+    prev = out;
+    out = out.replace(pattern, replacement);
+  } while (out !== prev);
+  return out;
+}
+
+function isAllowedHref(value) {
+  const v = value.trim().toLowerCase();
+  return v.startsWith("#") || v.startsWith("data:image/");
+}
+
+export function sanitizeSvg(svg) {
+  let out = svg;
+  out = replaceStable(out, /<script\b[\s\S]*?<\/script\b[^>]*>/gi, "");
+  out = replaceStable(out, /<script\b[^>]*\/>/gi, "");
+  out = replaceStable(out, /<style\b[\s\S]*?<\/style\b[^>]*>/gi, "");
+  out = replaceStable(out, /<foreignObject\b[\s\S]*?<\/foreignObject\b[^>]*>/gi, "");
+  out = replaceStable(out, /<foreignObject\b[^>]*\/>/gi, "");
+  out = out.replace(/<\/(?:script|style|foreignObject)\b[^>]*>/gi, "");
+  out = replaceStable(out, /\son[a-z]+\s*=\s*"[^"]*"/gi, "");
+  out = replaceStable(out, /\son[a-z]+\s*=\s*'[^']*'/gi, "");
+  out = replaceStable(out, /\son[a-z]+\s*=\s*[^\s>'"]+/gi, "");
+  out = out.replace(/\s(href|xlink:href)\s*=\s*"([^"]*)"/gi, (m, _attr, value) =>
+    isAllowedHref(value) ? m : "",
+  );
+  out = out.replace(/\s(href|xlink:href)\s*=\s*'([^']*)'/gi, (m, _attr, value) =>
+    isAllowedHref(value) ? m : "",
+  );
+  return out;
+}
diff --git a/packages/core/package-subpaths.json b/packages/core/package-subpaths.json
index f4e53543cb..c520a7e9da 100644
--- a/packages/core/package-subpaths.json
+++ b/packages/core/package-subpaths.json
@@ -44,12 +44,6 @@
       "types": "./dist/utils/richTextSanitize.d.ts",
       "environments": ["browser", "bun", "node"]
     },
-    "./sanitize-svg": {
-      "source": "./src/figma/sanitizeSvg.ts",
-      "runtime": "./dist/figma/sanitizeSvg.js",
-      "types": "./dist/figma/sanitizeSvg.d.ts",
-      "environments": ["browser", "bun", "node"]
-    },
     "./composition-contract": {
       "source": "./src/compositionContract.ts",
       "runtime": "./dist/compositionContract.js",
diff --git a/packages/core/package.json b/packages/core/package.json
index ea5c0ee72d..f7c2a3db8e 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -58,12 +58,6 @@
       "import": "./src/utils/richTextSanitize.ts",
       "types": "./src/utils/richTextSanitize.ts"
     },
-    "./sanitize-svg": {
-      "bun": "./src/figma/sanitizeSvg.ts",
-      "node": "./dist/figma/sanitizeSvg.js",
-      "import": "./src/figma/sanitizeSvg.ts",
-      "types": "./src/figma/sanitizeSvg.ts"
-    },
     "./composition-contract": {
       "bun": "./src/compositionContract.ts",
       "node": "./dist/compositionContract.js",
@@ -468,10 +462,6 @@
         "import": "./dist/utils/richTextSanitize.js",
         "types": "./dist/utils/richTextSanitize.d.ts"
       },
-      "./sanitize-svg": {
-        "import": "./dist/figma/sanitizeSvg.js",
-        "types": "./dist/figma/sanitizeSvg.d.ts"
-      },
       "./composition-contract": {
         "import": "./dist/compositionContract.js",
         "types": "./dist/compositionContract.d.ts"
diff --git a/scripts/check-svg-sanitize-parity.test.mjs b/scripts/check-svg-sanitize-parity.test.mjs
new file mode 100644
index 0000000000..f6dbccfab8
--- /dev/null
+++ b/scripts/check-svg-sanitize-parity.test.mjs
@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { sanitizeSvg as coreSanitizeSvg } from "../packages/core/src/figma/sanitizeSvg.ts";
+import { sanitizeSvg as mediaUseSanitizeSvg } from "../packages/cli/src/media-use/lib/svg-sanitize.mjs";
+
+// media-use/lib/svg-sanitize.mjs is a hand-kept port of
+// packages/core/src/figma/sanitizeSvg.ts (media-use's test lane forbids
+// workspace imports). This corpus is the trip wire: if either changes
+// without the other, one of these cases stops matching.
+const HOSTILE_CORPUS = [
+  ["<svg><script>alert(1)</script><rect/></svg>", "script element"],
+  ['<svg><script src="//evil"/></svg>', "self-closing script"],
+  ['<svg><style>@import "//evil";</style></svg>', "style block"],
+  ['<svg><foreignObject><body onload="alert(1)"/></foreignObject></svg>', "foreignObject subtree"],
+  ["<svg><foreignObject/></svg>", "self-closing foreignObject"],
+  ['<svg><rect onload="alert(1)"/></svg>', "quoted on* handler"],
+  [`<svg><rect onload='alert(1)'/></svg>`, "single-quoted on* handler"],
+  ["<svg><rect onload=alert(1)/></svg>", "unquoted on* handler"],
+  ['<svg><a href="javascript:alert(1)"><rect/></a></svg>', "javascript: href"],
+  ['<svg><a xlink:href="javascript:alert(1)"><rect/></a></svg>', "javascript: xlink:href"],
+  ['<svg><a href="data:image/png;base64,AA=="><rect/></a></svg>', "allowed data:image/ href"],
+  ['<svg><a href="#clip"><rect/></a></svg>', "allowed local fragment href"],
+  ['<svg><a href="data:text/html,<script>1</script>"><rect/></a></svg>', "data:text/html href"],
+  [
+    "<svg><script>a</script><script>/*<script>*/nested()</script></svg>",
+    "nested/overlapping script tags",
+  ],
+  [
+    "<svg><foreignObject><foreignObject><script>1</script></foreignObject></foreignObject></svg>",
+    "nested foreignObject",
+  ],
+  [
+    '<svg xmlns="http://www.w3.org/2000/svg"><svg><rect onclick="a"/></svg></svg>',
+    "nested svg element",
+  ],
+  ["<svg><rect onMouseOver=\"alert('x')\" ONCLICK='y'/></svg>", "mixed-case on* handler names"],
+  ['<svg><a HREF="javascript:alert(1)"><rect/></a></svg>', "mixed-case href attribute name"],
+];
+
+describe("svg-sanitize parity: core vs media-use port", () => {
+  for (const [input, label] of HOSTILE_CORPUS) {
+    it(`matches core output for: ${label}`, () => {
+      assert.equal(mediaUseSanitizeSvg(input), coreSanitizeSvg(input));
+    });
+  }
+
+  it("both strip every hostile marker from the full corpus", () => {
+    for (const [input] of HOSTILE_CORPUS) {
+      const out = mediaUseSanitizeSvg(input);
+      assert.ok(!/<script\b/i.test(out), `<script survived: ${input}`);
+      assert.ok(!/<foreignObject\b/i.test(out), `<foreignObject survived: ${input}`);
+      assert.ok(!/\son\w+\s*=/i.test(out), `on* handler survived: ${input}`);
+      assert.ok(!/javascript:/i.test(out), `javascript: href survived: ${input}`);
+    }
+  });
+});