GHSA-f2pc-rwv3-69mv
XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.
The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.
<svg xmlns="http://www.w3.org/2000/svg">
<a>
<animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
<text y="30">Click set</text>
</a>
</svg>
Ammonia did not apply attribute filters based on attributeName,
so the contents of the to, from, and values tags were not sanitized as URLs.
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
This vulnerability was reported by ucsurf.
What each source reports
OSVRUSTSEC-2021-0158No score
XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.
The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.
<svg xmlns="http://www.w3.org/2000/svg">
<a>
<animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
<text y="30">Click set</text>
</a>
</svg>
Ammonia did not apply attribute filters based on attributeName,
so the contents of the to, from, and values tags were not sanitized as URLs.
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
This vulnerability was reported by ucsurf.
- Record
RUSTSEC-2021-0158- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ammoniacrates.io | 0.0.0-0 up to 4.1.7, 4.2.0 up to 4.2.3 | 4.1.74.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-f2pc-rwv3-69mv is a vulnerability with no CVSS score yet in ammonia, published October 10, 2021. No source lists public exploit code. Fixed in ammonia 4.1.7.