{"id":"GHSA-m6mh-2hw2-555x","summary":"Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","details":"The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.\n\n```svg\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n  \u003ca\u003e\n    \u003cset attributeName=\"href\" to=\"javascript:alert('SET_XSS')\"\u003e\u003c/set\u003e\n    \u003ctext y=\"30\"\u003eClick set\u003c/text\u003e\n  \u003c/a\u003e\n\u003c/svg\u003e\n```\n\n### Impact\n\nAllows stored XSS in applications that allow the `animate` and `set` tags.\n\n### Patches\n\nFixed in 3.3.3, 4.0.3, and 4.1.4\n\n### Workarounds\n\nDo not enable the `animate` or `set` tags.","aliases":["CVE-2026-102342","RUSTSEC-2026-0213"],"modified":"2026-09-29T23:25:44.070111673Z","published":"2026-09-29T23:09:16Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-29T23:09:16Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/250"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/251"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/252"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"},{"type":"PACKAGE","url":"https://github.com/rust-ammonia/ammonia"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0213.html"}],"affected":[{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c 3.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m6mh-2hw2-555x/GHSA-m6mh-2hw2-555x.json"}},{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 4.0.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m6mh-2hw2-555x/GHSA-m6mh-2hw2-555x.json"}},{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.2"},{"fixed":"4.1.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 4.1.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m6mh-2hw2-555x/GHSA-m6mh-2hw2-555x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}