Every CVE Search/ Get API key

CVE-2026-102342

ammonia allows stored XSS through unsanitized SVG animate and set attributes

5.4 MediumFix available

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.27%Down 0.1 points since Oct 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

ammonia allows stored XSS through unsanitized SVG animate and set attributes

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
CVE-2026-102342
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-98766 5.4

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
EUVD-2026-98766
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m6mh-2hw2-555x 5.4

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Impact

Allows stored XSS in applications that allow the animate and set tags.

Patches

Fixed in 3.3.3, 4.0.3, and 4.1.4

Workarounds

Do not enable the animate or set tags.

Record
GHSA-m6mh-2hw2-555x
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.4

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
CVE-2026-102342
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

ammonia allows stored XSS through unsanitized SVG animate and set attributes

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
CVE-2026-102342
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-102342 5.4

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
DEBIAN-CVE-2026-102342
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-m6mh-2hw2-555x 5.4

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Impact

Allows stored XSS in applications that allow the animate and set tags.

Patches

Fixed in 3.3.3, 4.0.3, and 4.1.4

Workarounds

Do not enable the animate or set tags.

Record
GHSA-m6mh-2hw2-555x
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2026-102342 5.4

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
UBUNTU-CVE-2026-102342
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-108048 No score

CVE-2026-102342 affecting package rust 1.75.0-31

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
AZL-108048
Updated
2026-11-02
OSVAZL-108051 No score

CVE-2026-102342 affecting package rust 1.96.1-2

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Record
AZL-108051
Updated
2026-11-02
OSVRUSTSEC-2026-0213 No score

XSS in ammonia via SVG `animate` and `set` animation tags

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

Record
RUSTSEC-2026-0213
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ammonia
crates.io
 before 3.3.2
3.3.2
ammonia
crates.io
 4.0.0 to 4.0.2
4.0.3
ammonia
crates.io
 4.1.2 to 4.1.3
4.1.4
rust
Azure Linux:3
 through 1.75.0-31 None known
rust
Azure Linux:3
 1.85.0 to 1.96.1-2 None known
rust-ammonia
Debian:12
 All versions, plus listed versions
3.2.1-13.3.0-14.0.0-14.0.0-24.0.0-3
Show 6 moreShow less
4.1.1-14.1.2-14.1.2-24.1.3-14.1.4-14.2.3-1
 None known
rust-ammonia
Debian:13
 All versions, plus listed versions
4.0.0-34.1.1-14.1.2-14.1.2-24.1.3-14.1.4-14.2.3-1
 None known
rust-ammonia
Debian:14
 before 4.1.4-1, plus listed versions
4.0.0-34.1.1-14.1.2-14.1.2-24.1.3-1
4.1.4-1
ammonia
crates.io
 before 3.3.3
3.3.3
ammonia
crates.io
 4.0.0 up to 4.0.3
4.0.3
Show 6 moreShow less
Affected packages
PackageAffectedFixed
ammonia
crates.io
 4.1.2 up to 4.1.4
4.1.4
ammonia
crates.io
 0.0.0-0 up to 3.3.3, 4.0.0 up to 4.0.3, 4.1.0 up to 4.1.4
3.3.34.0.34.1.4
rust-ammonia
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.1.0-23.1.2-1
 None known
rust-ammonia
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.1-13.3.0-1
 None known
rust-ammonia
Ubuntu:26.10
 All versions, plus listed versions
4.1.2-14.1.4-1
 None known
rust-ammonia
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.0.0-34.1.2-1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-102342 is a medium vulnerability (CVSS 5.4) in Rust-ammonia Ammonia, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in ammonia 3.3.2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open