{"id":"GHSA-m6mh-2hw2-555x","revision":"6941c3a8b8ce4a2899ecf841aba5b7ba","records":[{"revision":"6941c3a8b8ce4a2899ecf841aba5b7ba","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-m6mh-2hw2-555x","aliases":["CVE-2026-102342","RUSTSEC-2026-0213"],"title":"Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.\n\n```svg\n<svg xmlns=\"http://www.w3.org/2000/svg\">\n  <a>\n    <set attributeName=\"href\" to=\"javascript:alert('SET_XSS')\"></set>\n    <text y=\"30\">Click set</text>\n  </a>\n</svg>\n```\n\n### Impact\n\nAllows stored XSS in applications that allow the `animate` and `set` tags.\n\n### Patches\n\nFixed in 3.3.3, 4.0.3, and 4.1.4\n\n### Workarounds\n\nDo not enable the `animate` or `set` tags.","state":0,"publishedAt":"2026-09-29T23:09:16+00:00","modifiedAt":"2026-09-29T23:25:44.0701117+00:00","affected":[{"ecosystem":"crates.io","name":"ammonia","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.3.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"ammonia","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.0.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"ammonia","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.1.2"},{"kind":"fixed","version":"4.1.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x","https://github.com/rust-ammonia/ammonia/pull/250","https://github.com/rust-ammonia/ammonia/pull/251","https://github.com/rust-ammonia/ammonia/pull/252","https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989","https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6","https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d","https://github.com/rust-ammonia/ammonia","https://rustsec.org/advisories/RUSTSEC-2026-0213.html"],"sourceUrl":"https://github.com/advisories/GHSA-m6mh-2hw2-555x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m6mh-2hw2-555x","identifiers":["GHSA-m6mh-2hw2-555x","CVE-2026-102342","RUSTSEC-2026-0213"]},"retained":false,"historicalAffected":[]}],"coverage":[]}