GHSA-p2g9-94wh-65c2
Space bug in `clean_text`
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("<div title={}>", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use clean_text at all.
What each source reports
GitHub AdvisoriesNo score
Space bug in `clean_text`
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("<div title={}>", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use clean_text at all.
- Record
GHSA-p2g9-94wh-65c2- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Space bug in `clean_text`
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("<div title={}>", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use clean_text at all.
- Record
GHSA-p2g9-94wh-65c2- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRUSTSEC-2022-0003No score
Space bug in `clean_text`
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("<div title={}>", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use clean_text at all.
- Record
RUSTSEC-2022-0003- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ammoniacrates.io | 3.0.0 up to 3.1.3 | 3.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-p2g9-94wh-65c2 is a vulnerability with no CVSS score yet in ammonia, published January 19, 2022. No source lists public exploit code. Fixed in ammonia 3.1.3.