{"id":"RUSTSEC-2025-0071","summary":"Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal","details":"Affected versions of this crate did not correctly strip namespace-incompatible tags\nin certain situations, causing it to incorrectly account for differences between HTML,\nSVG, and MathML.\n\nThis vulnerability only has an effect when the `svg` or `math` tag is allowed,\nbecause it relies on a tag being parsed as html during the cleaning process, but\nserialized in a way that causes in to be parsed as xml by the browser.\n\nAdditionally, the application using this library must allow a tag that is parsed as raw text in HTML.\nThese [elements] are:\n\n* title\n* textarea\n* xmp\n* iframe\n* noembed\n* noframes\n* plaintext\n* noscript\n* style\n* script\n\nApplications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.\n\n[elements]: https://github.com/servo/html5ever/blob/57eb334c0ffccc6f88d563419f0fbeef6ff5741c/html5ever/src/tree_builder/rules.rs","aliases":["GHSA-mm7x-qfjj-5g2c"],"modified":"2025-10-28T06:29:25.438486Z","published":"2025-09-21T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/ammonia"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2025-0071.html"}],"affected":[{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.3.1"},{"introduced":"4.0.0"},{"fixed":"4.0.1"},{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["format-injection"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0071.json"}}],"schema_version":"1.7.3"}