---
id: RUSTSEC-2026-0213
aliases:
  - GHSA-m6mh-2hw2-555x
title: XSS in ammonia via SVG `animate` and `set` animation tags
summary: XSS in ammonia via SVG `animate` and `set` animation tags
severity: none
vendor: ammonia
product: ammonia
ecosystem: rust
affected:
  - 'ammonia >= 4.1.0, < 4.1.4'
patched:
  - ammonia 4.1.4
published: '2026-07-21'
updated: '2026-07-22'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0213'
references:
  - url: 'https://crates.io/crates/ammonia'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0213.html'
tags:
  - osv
  - rust
ingestedAt: '2026-07-22T15:33:23.975Z'
---

## Overview

The following SVG will produce a link with a javascript scheme.
If the user clicks this link, they will run it.

```xml
<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>
```

Ammonia did not apply attribute filters based on `attributeName`,
so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected,
since neither are allowed by default.

---

**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)

## Affected packages

- `ammonia >= 4.1.0, < 4.1.4`

## Remediation

Upgrade to a patched release:

- `ammonia 4.1.4`