Vulnerability GHSA-p2g9-94wh-65c2

Medium Risk

4 years ago

Space bug in `clean_text`

3.0.0 - 3.1.2

Summary

Space bug in `clean_text`

Details

An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:

let html = format!("<div title={}>", clean_text(user_supplied_string));

Applications are not affected if they quote their attributes, or if they don't use clean_text at all.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

2 hours ago

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

0.1.0 - 0.7.0 and 1.0.0 - 3.3.2 and 4.0.0 - 4.0.2 and 4.1.2 - 4.1.3 GHSA-m6mh-2hw2-555x

Unknown

2 months ago

XSS in ammonia via SVG `animate` and `set` animation tags

0.1.0 - 0.7.0 and 1.0.0 - 3.3.2 RUSTSEC-2026-0213

Unknown

3 months ago

mXSS in ammonia via MathML `annotation-xml` encoding strip

0.1.0 - 0.7.0 and 1.0.0 - 3.3.1 RUSTSEC-2026-0193

Low Risk

1 year ago

Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

0.1.0 - 0.7.0 and 1.0.0 - 3.3.0 and 4.0.0 and 4.1.0 - 4.1.1 GHSA-mm7x-qfjj-5g2c

Unknown

1 year ago

Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal

0.1.0 - 0.7.0 and 1.0.0 - 3.3.0 RUSTSEC-2025-0071

View all vulnerabilities for these packages

Impacted packages

ammonia

Timeline

Published

4 years ago

Fixed (3.1.3)

4 years ago

Last Modified

2 years ago