CVE-2026-102342
mediumammonia is a Rust library for repairing and securing untrusted HTML.
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/pull/250 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/pull/251 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/pull/252 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4 security-advisories@github.com
- https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x security-advisories@github.com