~ / search / GHSA-m6mh-2hw2-555x

GHSA-m6mh-2hw2-555x

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-102342

Packages

EcosystemPackageAffectedFixed in
crates.io ammonia < 3.3.3 3.3.3
crates.io ammonia >= 4.0.0, < 4.0.3 4.0.3
crates.io ammonia >= 4.1.2, < 4.1.4 4.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it. ```svg <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SET_XSS')"></set> <text y="30">Click set</text> </a> </svg> ``` ### Impact Allows stored XSS in applications that allow the `animate` and `set` tags. ### Patches Fixed in 3.3.3, 4.0.3, and 4.1.4 ### Workarounds Do not enable the `animate` or `set` tags.

References

External links from the advisory. They lead to third-party sites.