---
id: RUSTSEC-2021-0158
aliases:
  - GHSA-f2pc-rwv3-69mv
title: >-
  XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or
  `animateColor` tags
summary: >-
  XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or
  `animateColor` tags
severity: none
vendor: ammonia
product: ammonia
ecosystem: rust
affected:
  - 'ammonia >= 4.2.0, < 4.2.3'
patched:
  - ammonia 4.2.3
published: '2021-10-10'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T07:30:02.289306454Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2021-0158'
references:
  - url: 'https://crates.io/crates/ammonia'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2021-0158.html'
  - url: 'https://github.com/rust-ammonia/ammonia/pull/261'
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.154Z'
---

## Overview

The neutralization that ammonia applied to `animate` and `set` was not applied to other forms of SVG animation, which can be used for XSS.

The following SVG will produce a link with a javascript scheme.
If the user clicks this link, they will run it.

```xml
<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
    <text y="30">Click set</text>
  </a>
</svg>
```

Ammonia did not apply attribute filters based on `attributeName`,
so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.

Applications that do not explicitly allow any of these tags should not be affected,
since none are allowed by default.

---

This vulnerability was reported by [ucsurf](https://uc.surf).

## Affected packages

- `ammonia >= 4.2.0, < 4.2.3`

## Remediation

Upgrade to a patched release:

- `ammonia 4.2.3`