XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

The neutralization that ammonia applied to `animate` and `set` was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. ```xml <svg xmlns="http://www.w3.org/2000/svg"> <a> <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion> <text y="30">Click set</text> </a> </svg> ``` Ammonia did not apply attribute filters based on `attributeName`, so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs. Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default. --- This vulnerability was reported by [ucsurf](https://uc.surf).

Source published

10 Oct 2021 12:00:00 UTC

Source modified

13 Oct 2026 07:30:02 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.