XSS in ammonia via SVG `animate` and `set` animation tags

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. ```xml <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SET_XSS')"></set> <text y="30">Click set</text> </a> </svg> ``` Ammonia did not apply attribute filters based on `attributeName`, so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs. Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default. --- **Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)

Source published

21 Jul 2026 12:00:00 UTC

Source modified

30 Sep 2026 07:15:39 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.