GHSA-9jh8-v38h-cvhr

Suggest an improvement
Source
https://github.com/advisories/GHSA-9jh8-v38h-cvhr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9jh8-v38h-cvhr/GHSA-9jh8-v38h-cvhr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9jh8-v38h-cvhr
Aliases
Published
2026-10-22T14:06:10Z
Modified
2026-10-22T14:16:23Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
ammonia: mXSS via MathML `annotation-xml` encoding strip
Details

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

  1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
  2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
  3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
  4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

  • title
  • textarea
  • xmp
  • iframe
  • noembed
  • noframes
  • plaintext
  • noscript
  • style
  • script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Impact

Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.

Patches

Workarounds

Call builder.add_clean_content_tags("annotation-xml") to remove the annotation-xml element and all of its children, including the XSS gadget.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-22T14:06:10Z",
    "nvd_published_at":  "2026-10-15T19:17:42Z",
    "severity":  "MODERATE"
}
References

Affected packages

crates.io / ammonia

Package

Name
ammonia
View open source insights on deps.dev
Purl
pkg:cargo/ammonia

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.3.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9jh8-v38h-cvhr/GHSA-9jh8-v38h-cvhr.json"

crates.io / ammonia

Package

Name
ammonia
View open source insights on deps.dev
Purl
pkg:cargo/ammonia

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9jh8-v38h-cvhr/GHSA-9jh8-v38h-cvhr.json"

crates.io / ammonia

Package

Name
ammonia
View open source insights on deps.dev
Purl
pkg:cargo/ammonia

Affected ranges

Type
SEMVER
Events
Introduced
4.1.0
Fixed
4.1.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9jh8-v38h-cvhr/GHSA-9jh8-v38h-cvhr.json"