---
id: RUSTSEC-2026-0345
aliases:
  - GHSA-3c48-9r95-hqhr
title: >-
  Untrusted labels can inject SVG attributes, CSS values, and terminal escape
  sequences
summary: >-
  Untrusted labels can inject SVG attributes, CSS values, and terminal escape
  sequences
severity: none
vendor: kuva
product: kuva
ecosystem: rust
affected:
  - 'kuva >= 0.4.0, < 0.4.1'
patched:
  - kuva 0.4.1
published: '2026-08-07'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:00:03.541371920Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0345'
references:
  - url: 'https://crates.io/crates/kuva'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0345.html'
  - url: >-
      https://github.com/Psy-Fer/kuva/commit/2b53ceb796bbb0e9bb537836ad19faac53a51852
  - url: >-
      https://github.com/Psy-Fer/kuva/commit/2219f5931913f79f3b9be47690b8999a3d8b8bfb
  - url: >-
      https://github.com/Psy-Fer/kuva/commit/76049ff5133dfb796ba759c2c5e486779d3d30c5
  - url: 'https://github.com/Psy-Fer/kuva/releases/tag/v0.4.1'
  - url: 'https://github.com/Psy-Fer/kuva/releases/tag/v0.3.1'
tags:
  - osv
  - rust
ingestedAt: '2026-10-15T11:47:08.229Z'
---

## Overview

Affected versions of `kuva` wrote data-derived strings straight into rendered
output without escaping them for the target format. Applications that plot
untrusted input (column headers, category and group names, series labels)
were affected in three places.

**1. SVG attribute injection / stored XSS (CWE-79).** When SVG interactivity
was enabled via `Layout::with_interactive`, group and category labels were
formatted directly into `data-group` and `data-x` attributes through the raw
`Primitive::GroupStart.extra_attrs` string, which the SVG backend emitted
verbatim. The backend's escaping helper covered text nodes and `<title>` but
not attributes. A label containing a double quote could close the attribute
and add another, for example an event handler. Opening the resulting SVG in a
browser, or inlining it into an HTML page, executed the injected script.
Reachable from scatter, line, bar, and strip plots, and from legends.

**2. Unvalidated CSS and style attribute values (CWE-74).** `Color::Css`
wrote arbitrary strings into `fill` and `stroke`, `stroke-dasharray` was
emitted raw from the public dash-pattern builders, and the SVG root
`font-family` and `fill` plus the background rectangle `fill` were written
raw from layout and theme configuration. Applications that forwarded
user-supplied style values into the plotting API could have those values
break out of the attribute they were written into.

**3. Terminal escape sequence injection (CWE-150).** `TerminalBackend` stored
label characters unfiltered and emitted each one unconditionally when
producing its ANSI string. Control characters in a label, including ESC, OSC
sequences, and carriage returns, were written straight to the operator's
terminal. Depending on the emulator this allows forged or misleading output,
window title and clipboard manipulation, and reaching terminal emulator
vulnerabilities that are triggered by escape sequences.

The fix routes every data-derived string through format-appropriate
escaping. A single `escape_attr` helper XML-escapes `&`, `<`, `>`, `"`, and
`'`, and is applied at each raw-attribute site: the `extra_attrs`
interpolations, the `Color::Css` catch-all, and the SVG backend's
`stroke-dasharray`, `font-family`, and background `fill` writes.
`TerminalBackend::set_char` replaces control characters with U+FFFD before
they enter the character grid, so one cell stays one column rather than the
grid shifting, and the ANSI writer emits the grid unchanged.

Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for
users still on 0.1.5 through 0.3.0. No versions were yanked.

Users who cannot upgrade should sanitize labels before passing them to
`kuva`, and avoid interactive SVG output for untrusted data.

Note that `Scene::defs`, `Scene::scripts`, and `Primitive::GroupStart.extra_attrs`
remain raw escape hatches by design. They are documented as trusted-only and
are not covered by this advisory; populating them from user data is
equivalent to executing that data.

## Affected packages

- `kuva >= 0.4.0, < 0.4.1`

## Remediation

Upgrade to a patched release:

- `kuva 0.4.1`