{"id":"RUSTSEC-2021-0158","revision":"cdd3348eb2a34cceb822c46908213c9d","records":[{"revision":"cdd3348eb2a34cceb822c46908213c9d","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2021-0158","aliases":["GHSA-f2pc-rwv3-69mv"],"title":"XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags","description":"The neutralization that ammonia applied to `animate` and `set` was not applied to other forms of SVG animation, which can be used for XSS.\n\nThe following SVG will produce a link with a javascript scheme.\nIf the user clicks this link, they will run it.\n\n```xml\n<svg xmlns=\"http://www.w3.org/2000/svg\">\n  <a>\n    <animateMotion attributeName=\"href\" to=\"javascript:alert('SET_XSS')\"></animateMotion>\n    <text y=\"30\">Click set</text>\n  </a>\n</svg>\n```\n\nAmmonia did not apply attribute filters based on `attributeName`,\nso the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.\n\nApplications that do not explicitly allow any of these tags should not be affected,\nsince none are allowed by default.\n\n---\n\nThis vulnerability was reported by [ucsurf](https://uc.surf).","state":0,"publishedAt":"2021-10-10T12:00:00+00:00","modifiedAt":"2026-10-13T07:30:02.2893065+00:00","affected":[{"ecosystem":"crates.io","name":"ammonia","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"4.1.7"},{"kind":"introduced","version":"4.2.0"},{"kind":"fixed","version":"4.2.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/ammonia","https://rustsec.org/advisories/RUSTSEC-2021-0158.html","https://github.com/rust-ammonia/ammonia/pull/261"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2021-0158","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2021-0158","identifiers":["RUSTSEC-2021-0158","GHSA-f2pc-rwv3-69mv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}