EUVD-2026-98766
GHSA-m6mh-2hw2-555x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to app accepting SVG content
-
DeliverySubmit crafted SVG with set/animate attributeName=href
-
ExploitSanitizer passes javascript: URL onto link
-
ExecutionPayload stored and served to victims
-
PersistVictim clicks link
-
ImpactScript executes in victim session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the consuming application to have explicitly added the SVG |
| Impact | This is a genuine but modestly-scoped vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4 Medium) reflects a stored XSS that is network-reachable and low-complexity but gated by two real limiters: it requires an authenticated/privileged content submitter (PR:L - the attacker must be able to get sanitized-then-stored SVG content into the application) and victim user interaction (UI:R - the victim must click the malicious link). The scope change (S:C) is appropriate because ammonia is a sanitization library whose job is to protect a downstream rendering context (the browser DOM/other users' sessions). No EPSS score, KEV listing, or public exploit is reported, so this is no public exploit identified at time of analysis - though a working proof-of-concept SVG is embedded directly in the vendor advisory, making weaponization trivial for anyone motivated. Crucially, the affected code path is NOT default: ammonia does not whitelist the SVG |
| Exploit ScenarioDerived | An attacker with the ability to submit content to an application that uses ammonia with the SVG |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Stored cross-site scripting in the Ammonia Rust HTML sanitizer affects versions 3.3.2 and earlier, 4.0.0 through 4.0.2, and 4.1.2 through 4.1.3 when a consuming application has explicitly whitelisted the SVG animate and set tags. An authenticated attacker with a content-submission path can craft an SVG whose <set> element sets attributeName="href" with a javascript: value, surviving sanitization because animation-target attribute names were never validated; the payload only fires if the victim clicks the resulting link (UI:R), yielding a scoped cross-site scripting impact (C:L/I:L). Ammonia's default configuration does not permit animate or set, so out-of-the-box deployments are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patches are available for all three affected lines: upgrade ammonia to 3.3.3 (from 3.3.2 and earlier), 4.0.3 (from the 4.0.x range), or 4.1.4 (from the 4.1.x range), which add explicit validation of attributeName, values, from, and to on SVG animate/set elements via the fixes in PRs 250, 251, and 252 and the associated commits. The most direct compensating control, confirmed by the vendor, is to remove animate and set from any custom tag whitelist passed to ammonia's Builder::add_tags/rm_tags configuration - since these tags are not enabled by default, this workaround fully eliminates the attack surface with no functional loss for applications that never intended to allow SVG animation, though it will break legitimate SVG animation content if such content is required. Because exploitation depends on an authenticated content-submission path and on the victim clicking the injected link, additional defense-in-depth is to enforce a strict Content-Security-Policy that omits unsafe-inline and disallows javascript: script sources, and to re-sanitize or strip stored SVG content that predates the upgrade. Advisory references: https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x, https://github.com/advisories/GHSA-m6mh-2hw2-555x, and https://rustsec.org/advisories/RUSTSEC-2026-0213.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ammonia is a Rust HTML sanitization library commonly used to clean untrusted, user-supplied markup before rendering (for example in web applications and comment systems). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), realized specifically as a URL-scheme bypass: Ammonia's attribute filter applies is_url_attr and scheme checks to attributes present literally on an element, but did not track attributes injected at runtime by SVG animation elements. SVG's <set> and <animate> elements carry an attributeName plus to/from/values, which the SVG engine applies to a target element after parsing - so a <set attributeName="href" to="javascript:..."> inside an <a> produces an href the sanitizer never inspected. The upstream fix (PRs 250, 251, 252 and commits 9394bd8, 9e3335e, d2ae154) builds an id-to-tag-name map over the DOM, threads parent context through clean_child/adjust_node_attributes, and explicitly validates attributeName/values/from/to on svg-namespaced animate and set elements. The CPE records identify the affected component as pkg:rust/ammonia; the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity issue requiring authenticated submission privileges and victim interaction, with changed scope and low confidentiality/integrity impact, and no availability impact.
Know when Rust gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered stored content (AV:N) with low complexity; submitter privilege needed (PR:L) and victim click required (UI:R); sanitizer bypass affects downstream browser context (S:C) with limited script-based C/I impact and no availability effect.
Primary rating from Vendor (https://github.com/rust-ammonia/ammonia).
CVSS VectorVendor: https://github.com/rust-ammonia/ammonia
DescriptionCVE.org
The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.
<svg xmlns="http://www.w3.org/2000/svg">
<a>
<set attributeName="href" to="javascript:alert('SET_XSS')"></set>
<text y="30">Click set</text>
</a>
</svg>Impact
Allows stored XSS in applications that allow the animate and set tags.
Patches
Fixed in 3.3.3, 4.0.3, and 4.1.4
Workarounds
Do not enable the animate or set tags.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the ele
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ove
Stored cross-site scripting and open redirect in Warpgate's SSO endpoints (versions prior to 0.25.5) allow an unauthenti
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginni
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a rem
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, c
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once fo
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe c
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no auth
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contai
Exploit-DB