Vulnerability RUSTSEC-2026-0213

Unknown

2 months ago

XSS in ammonia via SVG `animate` and `set` animation tags

0.1.0 - 0.7.0 and 1.0.0 - 3.3.2

Summary

XSS in ammonia via SVG `animate` and `set` animation tags

Details

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

2 hours ago

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

0.1.0 - 0.7.0 and 1.0.0 - 3.3.2 and 4.0.0 - 4.0.2 and 4.1.2 - 4.1.3 GHSA-m6mh-2hw2-555x

Unknown

3 months ago

mXSS in ammonia via MathML `annotation-xml` encoding strip

0.1.0 - 0.7.0 and 1.0.0 - 3.3.1 RUSTSEC-2026-0193

Low Risk

1 year ago

Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

0.1.0 - 0.7.0 and 1.0.0 - 3.3.0 and 4.0.0 and 4.1.0 - 4.1.1 GHSA-mm7x-qfjj-5g2c

Unknown

1 year ago

Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal

0.1.0 - 0.7.0 and 1.0.0 - 3.3.0 RUSTSEC-2025-0071

Medium Risk

4 years ago

Space bug in `clean_text`

3.0.0 - 3.1.2 GHSA-p2g9-94wh-65c2

View all vulnerabilities for these packages

Impacted packages

ammonia

Timeline

Published

2 months ago

Fixed (3.3.3)

2 months ago

Fixed (4.0.3)

2 months ago

Fixed (4.1.4)

2 months ago

Last Modified

1 hour ago