Vulnerability RUSTSEC-2026-0533

The MathML text integration points (mi, mo, mn, ms, mtext) and SVG foreignObject can be made to contain a tag in the other one's namespace (a MathML integration point with a child in the SVG namespace, or vice versa) without the root tag that switches out of the HTML namespace. If the attacker can construct input that parses differently in as HTML than as foreign XML, they can inject arbitrary JavaScript code into the user's browser.

For example:

• The user writes <math><mi><svg><gadget></svg></mi></math>.
• The application enables math, mi, and the gadget, but not svg.
• Ammonia filters the input to <math><mi><gadget></mi></math>.
• Because svg is now gone, the gadget switches from being parsed as SVG to being parsed as HTML.
• The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

As far as we know, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.