{"id":"RUSTSEC-2021-0158","aliases":["GHSA-f2pc-rwv3-69mv"],"title":"XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags","summary":"XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags","severity":"none","vendor":"ammonia","product":"ammonia","ecosystem":"rust","affected":["ammonia >= 4.2.0, < 4.2.3"],"patched":["ammonia 4.2.3"],"published":"2021-10-10","updated":"2026-10-13","sourceUpdated":"2026-10-13T07:30:02.289306454Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2021-0158","references":[{"url":"https://crates.io/crates/ammonia"},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0158.html"},{"url":"https://github.com/rust-ammonia/ammonia/pull/261"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.154Z","slug":"RUSTSEC-2021-0158","body":"## Overview\n\nThe neutralization that ammonia applied to `animate` and `set` was not applied to other forms of SVG animation, which can be used for XSS.\n\nThe following SVG will produce a link with a javascript scheme.\nIf the user clicks this link, they will run it.\n\n```xml\n<svg xmlns=\"http://www.w3.org/2000/svg\">\n  <a>\n    <animateMotion attributeName=\"href\" to=\"javascript:alert('SET_XSS')\"></animateMotion>\n    <text y=\"30\">Click set</text>\n  </a>\n</svg>\n```\n\nAmmonia did not apply attribute filters based on `attributeName`,\nso the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.\n\nApplications that do not explicitly allow any of these tags should not be affected,\nsince none are allowed by default.\n\n---\n\nThis vulnerability was reported by [ucsurf](https://uc.surf).\n\n## Affected packages\n\n- `ammonia >= 4.2.0, < 4.2.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ammonia 4.2.3`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}