All vulnerabilities
CVE-2026-102342GHSA-m6mh-2hw2-555xRUSTSEC-2026-0213

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

rust-ammonia ammoniarustLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.3Also 4.0.3, 4.1.4GitHub
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 3.3.3ammonia, rustGitHub
  • 4.0.3ammonia, rustGitHub
  • 4.1.4ammonia, rustGitHub
  • 3.3.3ammonia, crates.ioOSVcargo update -p ammonia --precise 3.3.3
  • 4.0.3ammonia, crates.ioOSVcargo update -p ammonia --precise 4.0.3
  • 4.1.4ammonia, crates.ioOSVcargo update -p ammonia --precise 4.1.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Impact

Allows stored XSS in applications that allow the animate and set tags.

Patches

Fixed in 3.3.3, 4.0.3, and 4.1.4

Workarounds

Do not enable the animate or set tags.

Text from GitHub Advisory Database

Affected versions 9

  • ammonia, rust< 3.3.2GitHub
  • ammonia, rust>= 4.0.0, <= 4.0.2GitHub
  • ammonia, rust>= 4.1.2, <= 4.1.3GitHub
  • ammoniaaffected: < 3.3.3CVE List
  • ammoniaaffected: >= 4.0.0, < 4.0.3CVE List
  • ammoniaaffected: >= 4.1.2, < 4.1.4CVE List
  • ammonia, crates.iofrom first release, fixed in 3.3.3OSV
  • ammonia, crates.iofrom 4.0.0, fixed in 4.0.3OSV
  • ammonia, crates.iofrom 4.1.2, fixed in 4.1.4OSV

References 12