diff --git a/types/operator_metadata.go b/types/operator_metadata.go
index b8015c6a..4f510161 100644
--- a/types/operator_metadata.go
+++ b/types/operator_metadata.go
@@ -111,7 +111,10 @@ func isImageURL(urlString string) bool {
 	extension := filepath.Ext(path)
 
 	// List of common image file extensions
-	imageExtensions := []string{".jpg", ".jpeg", ".png", ".gif", ".bmp", ".svg", ".webp"}
+	// Only support PNG for now to reduce surface area of image validation
+	// We do NOT want to support formats like SVG since they can be used for javascript injection
+	// If we get pushback on only supporting png, we can support jpg, jpeg, gif, etc. later
+	imageExtensions := []string{".png"}
 
 	// Check if the extension is in the list of image extensions
 	for _, imgExt := range imageExtensions {
diff --git a/types/operator_metadata_test.go b/types/operator_metadata_test.go
index 724686dd..cfde97de 100644
--- a/types/operator_metadata_test.go
+++ b/types/operator_metadata_test.go
@@ -41,6 +41,17 @@ func TestOperatorMetadata(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			name: "Invalid metadata - wrong image format",
+			metadata: OperatorMetadata{
+				Name:        "test",
+				Description: "My operator",
+				Logo:        "https://test.com/test.svg",
+				Twitter:     "https://twitter.com/test",
+				Website:     "https://test.com",
+			},
+			wantErr: true,
+		},
 		{
 			name: "Invalid metadata - description > 500 characters",
 			metadata: OperatorMetadata{