Vulnerability-Lookup

GHSA-M6MH-2HW2-555X

Vulnerability from github – Published: 2026-09-29 23:09 – Updated: 2026-09-29 23:09

Summary

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Details

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Impact

Allows stored XSS in applications that allow the animate and set tags.

Patches

Fixed in 3.3.3, 4.0.3, and 4.1.4

Workarounds

Do not enable the animate or set tags.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 3.3.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.0.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.3"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.2"
            },
            {
              "fixed": "4.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-29T23:09:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.\n\n```svg\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n  \u003ca\u003e\n    \u003cset attributeName=\"href\" to=\"javascript:alert(\u0027SET_XSS\u0027)\"\u003e\u003c/set\u003e\n    \u003ctext y=\"30\"\u003eClick set\u003c/text\u003e\n  \u003c/a\u003e\n\u003c/svg\u003e\n```\n\n### Impact\n\nAllows stored XSS in applications that allow the `animate` and `set` tags.\n\n### Patches\n\nFixed in 3.3.3, 4.0.3, and 4.1.4\n\n### Workarounds\n\nDo not enable the `animate` or `set` tags.",
  "id": "GHSA-m6mh-2hw2-555x",
  "modified": "2026-09-29T23:09:16Z",
  "published": "2026-09-29T23:09:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/pull/250"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/pull/251"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/pull/252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rust-ammonia/ammonia"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0213.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ammonia: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}

RUSTSEC-2026-0213 (CVE-2026-102342)

Vulnerability from osv_rustsec – Published: 2026-07-21 12:00 – Updated: 2026-09-30 07:15 – Source website

Summary

XSS in ammonia via SVG `animate` and `set` animation tags

Details

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

References

URL

Type

	https://crates.io/crates/ammonia	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0213.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "format-injection"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia",
        "purl": "pkg:cargo/ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "3.3.3"
            },
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.3"
            },
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.4"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2026-102342",
    "GHSA-m6mh-2hw2-555x"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The following SVG will produce a link with a javascript scheme.\nIf the user clicks this link, they will run it.\n\n```xml\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n  \u003ca\u003e\n    \u003cset attributeName=\"href\" to=\"javascript:alert(\u0027SET_XSS\u0027)\"\u003e\u003c/set\u003e\n    \u003ctext y=\"30\"\u003eClick set\u003c/text\u003e\n  \u003c/a\u003e\n\u003c/svg\u003e\n```\n\nAmmonia did not apply attribute filters based on `attributeName`,\nso the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.\n\nApplications that do not explicitly allow either of these tags should not be affected,\nsince neither are allowed by default.\n\n---\n\n**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)",
  "id": "RUSTSEC-2026-0213",
  "modified": "2026-09-30T07:15:39Z",
  "published": "2026-07-21T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/ammonia"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0213.html"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "XSS in ammonia via SVG `animate` and `set` animation tags"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted