RUSTSEC-2021-0158

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2021-0158

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2021-0158.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2021-0158

Aliases

GHSA-f2pc-rwv3-69mv

Published

2021-10-10T12:00:00Z

Modified

2026-10-13T07:30:02Z

Summary

XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

Details

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

This vulnerability was reported by ucsurf.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / ammonia

Package

Name: ammonia; View open source insights on deps.dev
Purl: pkg:cargo/ammonia

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

4.1.7

Introduced

4.2.0

Fixed

4.2.3

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}