{"id":"RUSTSEC-2026-0213","aliases":["GHSA-m6mh-2hw2-555x"],"title":"XSS in ammonia via SVG `animate` and `set` animation tags","summary":"XSS in ammonia via SVG `animate` and `set` animation tags","severity":"none","vendor":"ammonia","product":"ammonia","ecosystem":"rust","affected":["ammonia >= 4.1.0, < 4.1.4"],"patched":["ammonia 4.1.4"],"published":"2026-07-21","updated":"2026-07-22","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0213","references":[{"url":"https://crates.io/crates/ammonia"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0213.html"}],"tags":["osv","rust"],"ingestedAt":"2026-07-22T15:33:23.975Z","slug":"RUSTSEC-2026-0213","body":"## Overview\n\nThe following SVG will produce a link with a javascript scheme.\nIf the user clicks this link, they will run it.\n\n```xml\n<svg xmlns=\"http://www.w3.org/2000/svg\">\n  <a>\n    <set attributeName=\"href\" to=\"javascript:alert('SET_XSS')\"></set>\n    <text y=\"30\">Click set</text>\n  </a>\n</svg>\n```\n\nAmmonia did not apply attribute filters based on `attributeName`,\nso the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.\n\nApplications that do not explicitly allow either of these tags should not be affected,\nsince neither are allowed by default.\n\n---\n\n**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)\n\n## Affected packages\n\n- `ammonia >= 4.1.0, < 4.1.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ammonia 4.1.4`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}