RUSTSEC-2026-0213

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0213

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0213.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0213

Aliases

GHSA-m6mh-2hw2-555x

Published

2026-07-21T12:00:00Z

Modified

2026-07-22T08:30:04.145886684Z

Summary

XSS in ammonia via SVG `animate` and `set` animation tags

Details

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / ammonia

Package

Name: ammonia; View open source insights on deps.dev
Purl: pkg:cargo/ammonia

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

3.3.3

Introduced

4.0.0

Fixed

4.0.3

Introduced

4.1.0

Fixed

4.1.4

Ecosystem specific

{
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    },
    "affected_functions": null
}

Database specific

cvss

null

source

"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0213.json"

informational

null