{"schema_version":"1.9.0","id":"GHSA-m6mh-2hw2-555x","published":"2026-09-29T23:09:16Z","modified":"2026-09-29T23:25:44.070111673Z","aliases":["CVE-2026-102342","RUSTSEC-2026-0213"],"summary":"Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","details":"The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.\n\n```svg\n<svg xmlns=\"http://www.w3.org/2000/svg\">\n  <a>\n    <set attributeName=\"href\" to=\"javascript:alert('SET_XSS')\"></set>\n    <text y=\"30\">Click set</text>\n  </a>\n</svg>\n```\n\n### Impact\n\nAllows stored XSS in applications that allow the `animate` and `set` tags.\n\n### Patches\n\nFixed in 3.3.3, 4.0.3, and 4.1.4\n\n### Workarounds\n\nDo not enable the `animate` or `set` tags.","affected":[{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}],"database_specific":{"last_known_affected_version_range":"< 3.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m6mh-2hw2-555x/GHSA-m6mh-2hw2-555x.json"}},{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 4.0.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m6mh-2hw2-555x/GHSA-m6mh-2hw2-555x.json"}},{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.2"},{"fixed":"4.1.4"}]}],"database_specific":{"last_known_affected_version_range":"<= 4.1.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m6mh-2hw2-555x/GHSA-m6mh-2hw2-555x.json"}}],"references":[{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/250"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/251"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/252"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"},{"type":"PACKAGE","url":"https://github.com/rust-ammonia/ammonia"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0213.html"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-09-29T23:09:16Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}