{"id":"RUSTSEC-2026-0213","revision":"9d28c63b84fd4f1781bb93bbbcdd147b","records":[{"revision":"9d28c63b84fd4f1781bb93bbbcdd147b","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0213","aliases":["CVE-2026-102342","GHSA-m6mh-2hw2-555x"],"title":"XSS in ammonia via SVG `animate` and `set` animation tags","description":"The following SVG will produce a link with a javascript scheme.\nIf the user clicks this link, they will run it.\n\n```xml\n<svg xmlns=\"http://www.w3.org/2000/svg\">\n  <a>\n    <set attributeName=\"href\" to=\"javascript:alert('SET_XSS')\"></set>\n    <text y=\"30\">Click set</text>\n  </a>\n</svg>\n```\n\nAmmonia did not apply attribute filters based on `attributeName`,\nso the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.\n\nApplications that do not explicitly allow either of these tags should not be affected,\nsince neither are allowed by default.\n\n---\n\n**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)","state":0,"publishedAt":"2026-07-21T12:00:00+00:00","modifiedAt":"2026-09-30T07:15:39+00:00","affected":[{"ecosystem":"crates.io","name":"ammonia","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"3.3.3"},{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.0.3"},{"kind":"introduced","version":"4.1.0"},{"kind":"fixed","version":"4.1.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/ammonia","https://rustsec.org/advisories/RUSTSEC-2026-0213.html"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0213","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0213","identifiers":["RUSTSEC-2026-0213","CVE-2026-102342","GHSA-m6mh-2hw2-555x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}